feat(mfa): passkey verification as a second factor

server/internal/api/handlers.go

@@ -45,6 +45,8 @@ func RegisterRoutes(r *gin.Engine) {
 	r.POST("/auth/login", auth.HandleLocalLogin)
 	r.POST("/auth/mfa/totp", auth.HandleMFATOTP)
 	r.POST("/auth/mfa/recovery", auth.HandleMFARecovery)
+	r.POST("/auth/mfa/webauthn/begin", auth.HandleMFAWebAuthnBegin)
+	r.POST("/auth/mfa/webauthn/finish", auth.HandleMFAWebAuthnFinish)
 	r.POST("/auth/mfa/enrol/totp/setup", auth.HandleEnrolTOTPSetup)
 	r.POST("/auth/mfa/enrol/totp/confirm", auth.HandleEnrolTOTPConfirm)
 	r.POST("/auth/logout", auth.HandleLogout)