feat: add auth subsystem with WebAuthn passkeys support

New modules: lib/auth, lib/auth_users, lib/db, lib/db_sqlite, lib/password,
lib/webauthn, daemon/handlers/auth, scripts/bootstrap_auth, tests/test_auth

Frontend: webui/api/auth, hoover/components/auth, pages/login, passkeys, users

Updates: daemon/iface and server, lib/common and nginx, pyproject.toml deps,
install script, server.py, app.js, and websocket/api clients

daemon/handlers/wireguard.py

@@ -302,7 +302,9 @@ def class_up(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
     run([WG_QUICK_BIN, "up", ifname], sudo=True, check=False)
     logger.info("WireGuard class '%s' tunnel '%s' brought up", class_key, ifname)
     sync_result = bus.emit(
-        SyncEvent("wireguard", "config_saved", {"action": "class_up", "class_key": class_key})
+        SyncEvent(
+            "wireguard", "config_saved", {"action": "class_up", "class_key": class_key}
+        )
     )
     refresh_state(["wireguard", *sync_result.affected_subsystems])
     return {"up": True, "interface": ifname}
@@ -332,7 +334,11 @@ def class_down(_request: Any, body: dict[str, Any] | None) -> dict[str, Any]:
     except Exception:
         pass
     sync_result = bus.emit(
-        SyncEvent("wireguard", "config_saved", {"action": "class_down", "class_key": class_key})
+        SyncEvent(
+            "wireguard",
+            "config_saved",
+            {"action": "class_down", "class_key": class_key},
+        )
     )
     refresh_state(["wireguard", *sync_result.affected_subsystems])
     return {"down": True, "interface": ifname}