Passkey auth

Local WebAuthn + PGLite. Works on mesh preview and funnel hosts (RP ID = current hostname). No Better Auth / cloud IdP.