Users with a registered passkey can now sign in via WebAuthn on the OIDC login page, skipping the Bluesky OAuth round-trip entirely. - Add POST /oauth/authorize/passkey endpoint - Wire PasskeyService through to OIDC authorize router - Add passkey button with inline WebAuthn JS (feature-detected) - 8 new tests for passkey authorize flow