fix: harden auth and fix frontend issues

- Add builtin admin user with full access, immutable permissions (lib/db.py, lib/auth_users.py, webui/static/pages/users.js)
- Fix passkeys TypeError on string throws (webui/static/pages/passkeys.js)
- Add zero-permission warning in create user modal (webui/static/pages/users.js)
- Restore readonly on proxy paths textarea (webui/static/pages/proxy.js)
- Mask credential ownership errors to prevent enumeration (lib/webauthn.py, tests/test_auth.py)

webui/static/pages/proxy.js

@@ -165,7 +165,7 @@ function editDomain(d, state) {
         postRender: (inner) => {
             const certSelect = inner.querySelector('#pe-cert');
             if (certSelect) certSelect.value = selectedCert;
-            for (const id of ['pe-domain', 'pe-backend']) {
+            for (const id of ['pe-domain', 'pe-backend', 'pe-paths']) {
                 const el = inner.querySelector('#' + id);
                 if (el) { el.readOnly = true; el.style.background = '#f5f5f5'; }
             }