Auth: rate limiter, WebAuthn domain awareness, misc fixes

- Rate limiter tracks failures only; success resets counter
- Record failures/successes after password verification, not before
- WebAuthn rp_id/origin resolved dynamically from request domain
- Management domains auto-discovered from nginx backend config
- All WebAuthn operations validate domain against management list
- Add GET /api/auth/webauthn/capable endpoint for frontend checks
- Frontend checkWebAuthnCapable() function for domain-gated UI
- Timing side-channel fix: pre-compute dummy hash at module load
- Builtin admin seeded with random password (logged at WARNING)
- Logout handler returns consistent response shape

lib/nginx.py

@@ -225,6 +225,33 @@ def get_domains() -> list[dict[str, Any]]:
     return result
 
 
+def get_management_domains() -> list[str]:
+    """Return domain names that serve the management UI.
+
+    Checks both backend-referenced paths (for migrated configs) and
+    inline paths (for legacy configs pending migration).
+
+    Returns:
+        List of domain name strings.
+    """
+    cfg = get_config()
+    backends = cfg.get("backends", {})
+    domains: list[str] = []
+    for name, dom in cfg.get("domains", {}).items():
+        # Check inline paths (pre-migration format)
+        inline_paths = dom.get("paths", {})
+        if any(p.get("is_management") for p in inline_paths.values()):
+            domains.append(name)
+            continue
+        # Check backend-referenced paths
+        backend_name = dom.get("backend", "")
+        if backend_name and backend_name in backends:
+            paths = backends[backend_name].get("paths", {})
+            if any(p.get("is_management") for p in paths.values()):
+                domains.append(name)
+    return domains
+
+
 # ------------------------------------------------------------------
 # Domain CRUD
 # ------------------------------------------------------------------
@@ -577,6 +604,7 @@ __all__ = [
     "generate_server_conf",
     "get_config",
     "get_domains",
+    "get_management_domains",
     "remove_domain",
     "save_config",
     "test_config",