Add passkey/WebAuthn support to the forward-auth proxy login flow, previously only available in the OIDC authorize flow: - New POST /auth/proxy/passkey endpoint - Passkey button + WebAuthn JS on proxy login page - 9 new tests for proxy passkey flow Security fixes from audit: - MFA verify endpoints require authentication (prevent unauthenticated brute-force) - Session expiry enforced in database query - OIDC logout redirect uses origin comparison (prevent open redirect) - PKCE plain method rejected, S256 uses constant-time comparison - Empty DID guard in token endpoint - Handle format validation in OIDC authorize - trust proxy configured for correct client IP - user_id NaN validation - Removed uuid package (use crypto.randomUUID())