feat: authenticate with a hardware security key

[epheterson]

Once security keys are enrolled on an Apple ID, Apple stops offering a 6-digit code and returns an fsaChallenge — a WebAuthn assertion request — from every 2FA endpoint. validate_2fa_code then has nothing to validate, and such an account cannot complete two-factor at all.

New surface:

api.security_key_challenge               # pending challenge, or None
api.confirm_security_key()               # sign with an attached key, submit, trust
api.confirm_security_key(assertion=...)  # submit an assertion built elsewhere
api.sign_security_key_challenge(c, dev)  # sign without submitting
api.fido2_devices                        # attached devices
build_security_key_assertion(...)        # assertion response -> Apple's payload

fido2 is imported lazily and only on the signing path, so it stays optional and callers that supply an assertion don't need it installed.

Two details that are easy to get wrong, both taken from Apple's sign-in bundle:

• an accepted assertion returns 409, not 2xx (250 is Apple's own "two-factor completed")
• the challenge in the payload is read back out of clientData, so the value signed and the value declared can't diverge

19 tests added, no network. Verified end to end against a real account and a YubiKey: one touch, hsaTrustedBrowser=True, session trusted.

Note tests/test_account.py::test_storage fails on main already, unrelated to this change.

[mandarons]

/oc please review this code.

[opencode-agent]

Model not found: opencode/minimax-m3-free. Did you mean: minimax-m3, hy3-free, mimo-v2.5-free?

opencode session  |  github run