Add test coverage and fix webauthn e2e tests to use real sessions

- Add test:e2e:coverage script with Bun's built-in coverage support
- Create bunfig.toml with coverage configuration (text + lcov reporters)
- Fix webauthn tests to create real database sessions/login requests
  instead of mock context objects that bypass auth middleware
- Add createUserAPIContext helper for cleaner test code
- Update security tests to expect NOT_FOUND when accessing other
  user's passkeys

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitignore

@@ -34,6 +34,9 @@ devenv.local.nix
 # TypeScript
 *.tsbuildinfo
 
+# Test coverage
+coverage/
+
 # Debug
 npm-debug.log*
 yarn-debug.log*