fix: harden auth and fix frontend issues

- Add builtin admin user with full access, immutable permissions (lib/db.py, lib/auth_users.py, webui/static/pages/users.js)
- Fix passkeys TypeError on string throws (webui/static/pages/passkeys.js)
- Add zero-permission warning in create user modal (webui/static/pages/users.js)
- Restore readonly on proxy paths textarea (webui/static/pages/proxy.js)
- Mask credential ownership errors to prevent enumeration (lib/webauthn.py, tests/test_auth.py)

lib/webauthn.py

@@ -337,7 +337,7 @@ def remove_credential(username: str, credential_id: str) -> bool:
     if not rows:
         raise ValueError(f"Credential {credential_id!r} not found")
     if rows[0]["username"] != username:
-        raise ValueError("Credential does not belong to this user")
+        raise ValueError(f"Credential {credential_id!r} not found")
 
     db.run(Q_DELETE_WEBAUTHN, (credential_id,))
     logger.info("WebAuthn credential removed: %s, %s", username, credential_id)