feat(testkit): add passkey browser flow

[jmgilman]

Summary

• add a browser-facing testkit passkey registration and login flow backed by the existing auth store and exchange path
• add public passkey/session helpers for server-side WebAuthn session storage without adding authkit HTTP handlers
• vendor @github/webauthn-json@2.1.1 for browser WebAuthn JSON handling and document local testkit passkey config

Testing

• go test ./passkey/session ./testkit/internal/httpui ./testkit/internal/authflow ./testkit/cmd/testkit
• go test ./...
• go test -tags=integration ./store/postgres ./testkit/internal/authflow
• moon run root:check --summary minimal
• git diff --check
• Chrome virtual-WebAuthn smoke: seed token login, passkey registration, logout, passkey login, paste creation

Notes

• authkit still does not provide HTTP handlers; passkey/session only packages reusable begin/finish session storage boilerplate.
• testkit cookies remain localhost-oriented; Secure-cookie hardening is deferred to a separate deployment/config decision.