Add test coverage and fix webauthn e2e tests to use real sessions

- Add test:e2e:coverage script with Bun's built-in coverage support
- Create bunfig.toml with coverage configuration (text + lcov reporters)
- Fix webauthn tests to create real database sessions/login requests
  instead of mock context objects that bypass auth middleware
- Add createUserAPIContext helper for cleaner test code
- Update security tests to expect NOT_FOUND when accessing other
  user's passkeys

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/api-server/bunfig.toml

@@ -0,0 +1,9 @@
+[test]
+# Coverage reporters: text for console, lcov for CI/tooling integration
+coverageReporter = ["text", "lcov"]
+
+# Output directory for lcov.info file
+coverageDir = "coverage"
+
+# Don't count test files in coverage metrics
+coverageSkipTestFiles = true