Add passkey (WebAuthn) authentication support

Enable passwordless login via passkeys as an alternative to password auth.
Users register passkeys from Settings; the login page offers both options.
WebAuthn is optional — only active when WEBAUTHN_RP_ID and WEBAUTHN_ORIGIN
env vars are set.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 24 insertions, 0 deletions

diff --git a/web/templates/passkeys_list.html b/web/templates/passkeys_list.html
new file mode 100644
index 0000000..4e05461
--- /dev/null
+++ b/web/templates/passkeys_list.html
@@ -0,0 +1,24 @@
+{{define "passkeys_list.html"}}
+<div class="items-list">
+    {{if .Passkeys}}
+        {{range .Passkeys}}
+        <div class="item-row" id="passkey-{{.ID}}">
+            <div class="item-name">
+                <strong>{{if .Name}}{{.Name}}{{else}}Passkey{{end}}</strong>
+                <div class="item-desc">Added {{.CreatedAt.Format "Jan 2, 2006"}}</div>
+            </div>
+            <button class="btn btn-danger btn-sm"
+                    hx-delete="/passkeys/{{.ID}}"
+                    hx-target="#passkey-{{.ID}}"
+                    hx-swap="outerHTML"
+                    hx-headers='{"X-CSRF-Token": "{{$.CSRFToken}}"}'
+                    hx-confirm="Delete this passkey?">
+                Delete
+            </button>
+        </div>
+        {{end}}
+    {{else}}
+        <div class="empty-state">No passkeys registered. Register one to enable passwordless login.</div>
+    {{end}}
+</div>
+{{end}}