Implement Workstream I: Account pages with code review fixes

Add account management UI with profile settings, authentication options,
device/passkey management, and session management pages.

Key changes:
- Add account pages: profile, auth, devices, sessions
- Add dialog components: confirm, add-passkey, change-password, rename-passkey
- Return passkeyId from verifyRegistration to fix race condition
- Add hasPassword field to user schema
- Add aria-label to dialog close button for accessibility
- Add avatar URL validation and fix phone input styling
- Add comprehensive test plan documentation

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/api-server/src/utils/webauthn.ts

@@ -157,7 +157,7 @@ export const verifyRegistration = async (
   userId: number,
   challengeId: number,
   response: RegistrationResponseJSON,
-): Promise<void> => {
+): Promise<{ passkeyId: number }> => {
   // Fetch the challenge
   const challengeRow = await db
     .selectFrom("webauthn_challenges")
@@ -207,7 +207,7 @@ export const verifyRegistration = async (
     guidName ?? `Key registered at ${formatPasskeyDate(new Date())}`;
 
   // Store the passkey
-  await db
+  const { id: passkeyId } = await db
     .insertInto("passkeys")
     .values({
       user_id: userId,
@@ -222,7 +222,10 @@ export const verifyRegistration = async (
       rpid: rpInfo.rpID,
       name: passKeyName,
     })
-    .execute();
+    .returning("id")
+    .executeTakeFirstOrThrow();
+
+  return { passkeyId: Number(passkeyId) };
 };
 
 /**