fix(mfa): wire up webauthn step-up routes

The missing /me/step-up/webauthn/begin and /finish were a plan defect,
not an acceptable gap: a user whose only factor is a passkey was
offered only recovery codes for step-up, burning one every ten
minutes. Adds the handlers in package auth (session-authenticated,
not themselves behind RequireStepUp, modeled on
HandleMFAWebAuthnBegin/finishAssertion) and registers both routes
behind the same RateLimitAuth() as /me/step-up. StepUpModal now offers
"Use passkey" when the server names webauthn and the browser supports
WebAuthn.

web/lib/api.ts

@@ -886,6 +886,17 @@ export const me = {
     stepUp(factor: { totp: string } | { recovery: string } | { password: string }): Promise<{ ok: true }> {
         return request("/me/step-up", { method: "POST", body: JSON.stringify(factor) });
     },
+
+    stepUpWebAuthnBegin(): Promise<{ publicKey: any; ceremony_id: string }> {
+        return request("/me/step-up/webauthn/begin", { method: "POST" });
+    },
+
+    stepUpWebAuthnFinish(ceremonyId: string, credential: unknown): Promise<{ ok: true }> {
+        return request("/me/step-up/webauthn/finish", {
+            method: "POST",
+            body: JSON.stringify({ ceremony_id: ceremonyId, credential }),
+        });
+    },
 };
 
 export const api = {