feat: add passkey management and auth policy sections to tenant settings

Adds PasskeySection (list/rename/delete passkeys), AuthPolicySection
(MFA mode + passkey enable/mode controls), and PasskeyNudgeBanner
(dismissable nudge for users without a passkey enrolled).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ui/package-lock.json

@@ -11,6 +11,7 @@
       "dependencies": {
         "@cameleer/design-system": "^0.1.54",
         "@logto/react": "^4.0.13",
+        "@simplewebauthn/browser": "^13.3.0",
         "@tanstack/react-query": "^5.90.0",
         "lucide-react": "^1.7.0",
         "qrcode.react": "^4.2.0",
@@ -1267,6 +1268,12 @@
         "pnpm": "^10.0.0"
       }
     },
+    "node_modules/@simplewebauthn/browser": {
+      "version": "13.3.0",
+      "resolved": "https://registry.npmjs.org/@simplewebauthn/browser/-/browser-13.3.0.tgz",
+      "integrity": "sha512-BE/UWv6FOToAdVk0EokzkqQQDOWtNydYlY6+OrmiZ5SCNmb41VehttboTetUM3T/fr6EAFYVXjz4My2wg230rQ==",
+      "license": "MIT"
+    },
     "node_modules/@standard-schema/spec": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",