Add passkey login for protected UI (#845)

* feat(auth): add passkey login for protected UI

* fix: polish passkey setup and correct WebAuthn user IDs

* feat: improve passkey login management

* build: align passkey deps with upstream main

* refactor: move ui auth out of opencode module

---------

Co-authored-by: Bohdan Triapitsyn <artmore@protonmail.com>

packages/web/server/lib/ui-auth/DOCUMENTATION.md

@@ -0,0 +1,38 @@
+# UI Auth Module Documentation
+
+## Purpose
+This module owns OpenChamber UI authentication for browser access, including password session auth, WebAuthn passkeys, and trusted-device session handling.
+
+## Entrypoints and structure
+- `packages/web/server/lib/ui-auth/ui-auth.js`: UI auth controller runtime, cookie/session issuance, rate limiting, and auth route handlers.
+- `packages/web/server/lib/ui-auth/ui-passkeys.js`: passkey store and WebAuthn registration/authentication verification helpers.
+
+## Public exports (ui-auth.js)
+- `createUiAuth({ password, cookieName, sessionTtlMs, readSettingsFromDiskMigrated })`: creates UI auth controller with methods:
+  - `enabled`
+  - `requireAuth(req, res, next)`
+  - `handleSessionStatus(req, res)`
+  - `handleSessionCreate(req, res)`
+  - `handlePasskeyStatus(req, res)`
+  - `handlePasskeyRegistrationOptions(req, res)`
+  - `handlePasskeyRegistrationVerify(req, res)`
+  - `handlePasskeyAuthenticationOptions(req, res)`
+  - `handlePasskeyAuthenticationVerify(req, res)`
+  - `handlePasskeyList(req, res)`
+  - `handlePasskeyRevoke(req, res)`
+  - `handleResetAuth(req, res)`
+  - `ensureSessionToken(req, res)`
+  - `dispose()`
+
+## Public exports (ui-passkeys.js)
+- `createUiPasskeys({ passwordBinding, readSettingsFromDiskMigrated, storeFile, rpName, challengeTtlMs })`: creates passkey runtime with methods:
+  - `enabled`
+  - `getStatus(req)`
+  - `listPasskeys(req)`
+  - `revokePasskey(req, passkeyId)`
+  - `clearAllPasskeys()`
+  - `beginRegistration(req, { label })`
+  - `finishRegistration(payload)`
+  - `beginAuthentication(req)`
+  - `finishAuthentication(payload)`
+  - `dispose()`