feat(passkey): passkey provider, passkey login and WebAuthn MFA (server)

[brkfun]

Part of a coordinated set of 3 pull requests — passbolt_api, passbolt_styleguide and
passbolt_browser_extension — that together add first-class passkey / WebAuthn support to Passbolt,
one of the most frequently requested capabilities from the community. The three features are:

1. Passkey provider — Passbolt acts as a WebAuthn authenticator for third-party websites
   (Dashlane / 1Password / Bitwarden style). Passkeys are created and stored inside the encrypted
   vault as a passkey resource type, offered inline via autofill (conditional mediation), and unlocked
   with the master passphrase or an optional PIN.
2. Passkey login (passwordless) — a user can enrol a passkey to sign in to Passbolt without typing
   their passphrase. The passphrase keeps working as a fallback (a lost passkey never locks anyone
   out). Split-kit design: the client half never leaves the browser profile, the server half is only
   released after a valid assertion.
3. Passkey as MFA — FIDO2 security keys as a second factor, alongside the existing
   TOTP / Yubikey / Duo providers.

The three repos must be deployed together. This PR is the API / server side.

---

This pull request is a (multiple allowed):

• bug fix
• change of existing behavior
• new feature

Checklist

• User stories are present (given, when, then format)
• Unit tests are passing
• Selenium tests are passing
• Check style is not triggering new error or warning

What you did

Server-side implementation of the three passkey features above.

New PasskeyAuthentication plugin (CE):

• Passwordless passkey login: /passkey/login/begin + /passkey/login/finish (unauthenticated,
  anti-enumeration — always 200), /passkey/setup/begin + /passkey/setup/finish (auth
  enrolment storing the credential + the server half of the passphrase kit), /passkey/collect.
• Management: GET /passkey/settings (list credentials), DELETE /passkey/settings/{id}
  (delete one by base64url credential id, or all).
• Organization toggle (CE, free): GET/POST /passkey/organization/settings to enable/disable
  passkey login org-wide (admin-only write, unauthenticated-readable).
• Non-resident credentials (RESIDENT_KEY_DISCOURAGED) so several passkeys can be enrolled per
  authenticator; login supplies the user id + allowCredentials.

MultiFactorAuthentication plugin: WebAuthn/FIDO2 as a new MFA provider (setup/verify
credentials table + email notifications), mirroring the Yubikey / TOTP / Duo structure.

Passkey provider storage: a v5-passkey-aware resource type + a passkeys array in the v5 secret
definitions, so provider passkeys are stored as encrypted vault secrets.

User stories

• Given an unauthenticated user with an enrolled passkey, when they start passkey login, then
  the server returns assertion options scoped to that user without revealing whether the
• Given an administrator, when they POST the organization passkey setting, then it is
  persisted; given a non-admin, when they POST, then they get 403.
• Given a user, when they delete a passkey by an unknown credential id, then

Fix included

PasskeyOrganizationSettingsService::setEnabled() persisted a raw array where the organization settings
table validates a UTF8 string, so the admin toggle 500'd on every save — now JSON-encode
read side and every other org setting.

Tests

39 new PHPUnit tests (controllers, services, organization settings) executed green locally against a
test DB; existing passkey tests still pass. composer cs-check clean.

[CLAassistant]

All committers have signed the CLA.

[eversiege]

I was just about to write an issue begging for passkeys to be added; outstanding work

[brkfun]

is there anything that i could do to help y'all about this PR? Or else you guys still checking these PR's out.

[stripthis]

@brkfun Yeah, we’re still checking these PRs out. That said, we’re probably not going to merge this one as-is. The plan is to ship this in multiple steps, MFA first, then SSO with passkeys, with passkeys themselves being treated as resource types.

So we’re looking at this PR more as a PoC that helps speed things up rather than something we’d consider finished and merge directly.

[brkfun]

Exactly thats why i just do this as a PoC. I don't recommend or encourage any user to use it. step by step you guys will collab into it. If you need any help about any PR or any section of the PR i'll here and ready to help.

Have a nice day!

[stripthis]

Thanks a lot @brkfun, your help is very much appreciated.

[drj-io]

Passkeys are becoming more critical for business, so I hope to see this merged into release soon. Please keep us updated! ❤️