Summary

Add opt-in WebAuthn passkey support to Chatto.

Intended behavior

• Email-first sign-up may finish with a passkey instead of a password.
• A username-free passkey button signs users in.
• Account settings manage multiple passkeys and use them for fresh authentication.
• A verified email or two remaining passkeys prevents removing the final recoverable sign-in method.

Delivery notes

• Preserve cookie and bearer session behavior.
• Store durable credentials in EVT and short-lived ceremonies in RUNTIME_STATE.
• Use additive protobuf API and discovery changes for mixed-version compatibility.