feat: add auth subsystem with WebAuthn passkeys support

New modules: lib/auth, lib/auth_users, lib/db, lib/db_sqlite, lib/password,
lib/webauthn, daemon/handlers/auth, scripts/bootstrap_auth, tests/test_auth

Frontend: webui/api/auth, hoover/components/auth, pages/login, passkeys, users

Updates: daemon/iface and server, lib/common and nginx, pyproject.toml deps,
install script, server.py, app.js, and websocket/api clients

tests/test_server.py

@@ -30,7 +30,11 @@ class TestSPARoutes:
 
     def test_api_routes_still_work(self, client):
         resp = client.get("/api/firewall/zones")
-        assert resp.status_code in (200, 500)
+        assert resp.status_code in (401, 500)
+        data = resp.get_json()
+        assert data is not None
+        assert data.get("ok") is False
+        assert data.get("error") == "unauthorized"
 
 
 class TestWsUrlGeneration:
@@ -47,8 +51,9 @@ class TestBlueprintsRegistered:
     def test_all_blueprints_registered(self, client):
         from webui.server import BLUEPRINTS
 
-        assert len(BLUEPRINTS) == 8
+        assert len(BLUEPRINTS) == 9
         names = [name for name, _ in BLUEPRINTS]
+        assert "auth" in names
         assert "firewall" in names
         assert "network" in names
         assert "dhcp" in names