fix(mfa): wire up webauthn step-up routes

The missing /me/step-up/webauthn/begin and /finish were a plan defect,
not an acceptable gap: a user whose only factor is a passkey was
offered only recovery codes for step-up, burning one every ten
minutes. Adds the handlers in package auth (session-authenticated,
not themselves behind RequireStepUp, modeled on
HandleMFAWebAuthnBegin/finishAssertion) and registers both routes
behind the same RateLimitAuth() as /me/step-up. StepUpModal now offers
"Use passkey" when the server names webauthn and the browser supports
WebAuthn.

server/internal/api/handlers.go

@@ -119,6 +119,8 @@ func RegisterRoutes(r *gin.Engine) {
 		apiGroup.PATCH("/me/passkeys/:id", renamePasskey)
 		apiGroup.DELETE("/me/passkeys/:id", auth.RequireStepUp(), deletePasskey)
 		apiGroup.POST("/me/step-up", RateLimitAuth(), stepUp)
+		apiGroup.POST("/me/step-up/webauthn/begin", RateLimitAuth(), auth.HandleStepUpWebAuthnBegin)
+		apiGroup.POST("/me/step-up/webauthn/finish", RateLimitAuth(), auth.HandleStepUpWebAuthnFinish)
 		apiGroup.DELETE("/org/users/:id/mfa", auth.RequireRole("owner", "admin"), auth.RequireStepUp(), resetUserMFA)
 
 		apiGroup.GET("/openapi.json", getOpenAPI)