fix: harden auth and fix frontend issues

- Add builtin admin user with full access, immutable permissions (lib/db.py, lib/auth_users.py, webui/static/pages/users.js)
- Fix passkeys TypeError on string throws (webui/static/pages/passkeys.js)
- Add zero-permission warning in create user modal (webui/static/pages/users.js)
- Restore readonly on proxy paths textarea (webui/static/pages/proxy.js)
- Mask credential ownership errors to prevent enumeration (lib/webauthn.py, tests/test_auth.py)

lib/auth_users.py

@@ -31,6 +31,9 @@ from lib.password import hash_password, needs_rehash, verify_password
 
 logger = logging.getLogger(__name__)
 
+# Builtin admin — hardcoded, full access, cannot be modified/deleted
+BUILTIN_ADMIN_USERNAME = "admin"
+
 # All subsystem names for default permission assignment
 ALL_SUBSYSTEMS = [
     "firewall",
@@ -211,7 +214,13 @@ def update_permissions(username: str, permissions: dict[str, str]) -> None:
     Args:
         username: The username.
         permissions: Dict mapping subsystem names to permission levels.
+
+    Raises:
+        ValueError: If attempting to modify builtin admin.
     """
+    if username == BUILTIN_ADMIN_USERNAME:
+        raise ValueError("Cannot modify permissions for builtin admin")
+
     user = find_user(username)
     if user is None:
         raise ValueError(f"User {username!r} not found")