Implement WebAuthn passkey authentication

Add complete WebAuthn support for passkey registration and authentication:
- Install @simplewebauthn/server for WebAuthn utilities
- Create passkey-helpers.ts with base64url/Uint8Array conversion utilities
- Create webauthn.ts with registration/authentication option generation and verification
- Create context.ts with API context types
- Implement all WebAuthn router handlers (createRegistrationOptions, verifyRegistration, createAuthenticationOptions, verifyAuthentication)
- Implement passkey management handlers (listPasskeys, createPasskey, renamePasskey, deletePasskey)
- Add WebAuthn configuration constants and environment variables

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/api-server/src/constants.ts

@@ -1,4 +1,29 @@
 /**
- * Default port for the API server
+ * API Server constants
  */
+
+/** Default port for the API server */
 export const DEFAULT_PORT = 9861;
+
+/** Default Relying Party name for WebAuthn */
+export const DEFAULT_RP_NAME = "Reviq Publisher Dashboard";
+
+/** WebAuthn challenge expiry in milliseconds (5 minutes) */
+export const WEBAUTHN_CHALLENGE_EXPIRY_MS = 5 * 60 * 1000;
+
+/**
+ * Get allowed WebAuthn origins from environment or defaults
+ */
+export const getAllowedOrigins = (): string[] => {
+  const envOrigins = Bun.env.ALLOWED_WEBAUTHN_ORIGINS;
+  if (envOrigins) {
+    return envOrigins.split(",").map((o) => o.trim());
+  }
+
+  // Default to localhost origins for development
+  return [
+    `http://localhost:${String(DEFAULT_PORT)}`,
+    "http://localhost:6827",
+    "http://localhost:6828",
+  ];
+};