Merge branch 'feature/iam-10-passwortlose-anmeldung-via-webauthn-passkey' into feature/qa-02-pruefgate-identitaet-mandanten

# Conflicts:
#	scripts/reset-test-env.sh
#	scripts/run-checks.sh

migrations/tenant/0003_webauthn.down.sql

@@ -0,0 +1,2 @@
+DROP TABLE IF EXISTS webauthn_challenges;
+DROP TABLE IF EXISTS webauthn_credentials;

migrations/tenant/0003_webauthn.up.sql

@@ -0,0 +1,23 @@
+-- Passwortlose Anmeldung via WebAuthn/Passkey (IAM-10, siehe
+-- core-kanban/tickets/IAM-10.md).
+CREATE TABLE webauthn_credentials (
+    id          UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id     UUID NOT NULL REFERENCES users(id),
+    device_name TEXT NOT NULL,
+    public_key  BYTEA NOT NULL,
+    sign_count  INT NOT NULL DEFAULT 0,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX webauthn_credentials_user_idx ON webauthn_credentials (user_id);
+
+-- Einmal-Challenges fuer Registrierung/Anmeldung (Replay-Schutz).
+CREATE TABLE webauthn_challenges (
+    id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id    UUID NOT NULL REFERENCES users(id),
+    challenge  TEXT NOT NULL UNIQUE,
+    purpose    TEXT NOT NULL CHECK (purpose IN ('register', 'login')),
+    expires_at TIMESTAMPTZ NOT NULL,
+    used_at    TIMESTAMPTZ,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);