Add optional face-verified WebAuthn/passkey platform authenticator (experimental)

[qilsklo]

Summary

This adds an optional, off-by-default software platform authenticator that
lets browsers create and use WebAuthn/passkeys unlocked by Howdy face
recognition. It presents a virtual FIDO2 HID device via the kernel's uhid
interface, so unmodified Firefox (≥114) and Chromium talk to it as if it
were a plugged-in security key — no browser extension, patch, or
native-messaging host required.

Flow: browser → CTAPHID over /dev/uhid → CTAP2 core → face verification (the same compare.py path PAM uses) → per-RP key signs the challenge.

None of this touches the existing PAM / login / sudo path. The feature is
not built or installed unless you configure Meson with -Dwith_webauthn=true,
and the daemon refuses to start unless explicitly enabled in config.ini.

What's included

• Internal face-verification API (verification.py) wrapping compare.py
  with a clean verify_face() / FaceVerifier interface. PAM is unchanged.
• CTAP2 authenticator core (webauthn/authenticator.py) — make_credential,
  get_assertion, get_info, etc., built on python-fido2 (no home-grown
  crypto or protocol). ES256, per-RP keys, persisted signing counter.
• Credential store with atomic, flock-guarded writes.
• Two keystores: a TPM 2.0 backend (keys generated and used inside the TPM
  via tpm2-pytss) and an AES-256-GCM software backend clearly labelled
  development-grade.
• CTAPHID + uhid transport so stock browsers see a FIDO2 device.
• Root daemon + hardened systemd unit + udev uaccess rule (all installed
  only behind -Dwith_webauthn).
• CLI: howdy webauthn {init,status,list,remove,register,authenticate,run}.
• Docs: docs/webauthn-design.md (architecture + threat model) and
  docs/webauthn.md (operator guide).
• Drive-by: fixes howdy test crashing on NumPy 2.x (cv2.calcHist indexing).

Security posture (deliberately honest)

This is convenience-grade, not a certified FIDO authenticator, and not
equivalent to Windows Hello or a hardware security key:

• Private keys are never stored in plaintext (TPM-sealed, or AES-256-GCM; the
  software keystore is filesystem-permission protected and marked as such).
• Successful face verification is required immediately before every
  credential operation — no caching.
• Never logs private keys, credential IDs, assertions, biometric embeddings,
  or secrets.
• RGB-only webcams give weaker presentation-attack resistance than IR/depth
  systems; this is documented.

Limitations

• Presents as a USB/roaming key, so browser prompts say "security key" and
  sites requiring authenticatorAttachment: "platform" may not offer it.
• ES256 only; self-attestation only; single user per running daemon.
• No autofill/platform-passkey D-Bus portal (credentialsd) integration yet —
  on the roadmap in the design doc.

Testing

83 unit + integration tests (python -m pytest tests/). The integration test
drives the full stack with python-fido2's own CTAP2 client over an in-memory
loopback (no root/uhid needed), verifying registration, self-attestation and
assertion signatures, and counter increments against an independent
implementation.

Try it

meson setup build -Dwith_webauthn=true && meson compile -C build && sudo meson install -C build
# config.ini: [webauthn] enabled = true
sudo howdy webauthn init
sudo systemctl enable --now howdy-webauthn
# then register a passkey at e.g. https://webauthn.io

New dependency: python-fido2 (required for the feature only). Optional:
tpm2-tss + python-tpm2-pytss for the TPM keystore.