Add passkey authentication to remix/auth

[janhesters]

Add first-party passkey registration and sign-in primitives to Remix 3's auth stack.

remix/auth provides credentials, OAuth, and OIDC primitives, but applications currently have to add WebAuthn registration, authentication, credential storage, and browser integration themselves. Passkeys would let users sign in with their device's biometric or PIN verification, or a security key, without an application password.

User experience

• A signed-in user adds a passkey to their account through the browser's native prompt.
• The user returns and signs in with that passkey.
• Support discoverable credentials for sign-in without entering a username, plus browser autofill through conditional UI where available.
• Users can view their registered passkeys, give them recognizable names, and revoke them.

Requested behavior

• Provide composable server primitives for generating registration/authentication options and verifying the returned WebAuthn responses.
• Provide browser helpers or documented native WebAuthn usage that works with Remix components.
• Let applications configure the relying party ID, expected origins, and user-verification policy.
• Use cryptographically secure, expiring challenges bound to the intended ceremony and account where applicable. Reject replay, origin/RP mismatches, invalid signatures, and responses that fail the configured user-verification policy.
• Let applications own user and credential storage through an adapter or callbacks. Support multiple passkeys per user and persist the credential ID, public key, counter, transports, and backup/device metadata needed for verification.
• Compose a verified identity with completeAuth() and the existing session/auth middleware. Keep account lookup, authorization, and recovery policy under application control.
• Handle unsupported browsers, cancellation, and verification failures with results applications can use to render their own UI.

Examples and validation

Include an end-to-end registration and sign-in example, credential management, and optional conditional UI. Cover successful ceremonies, expired/reused challenges, concurrent redemption, origin/RP mismatches, invalid responses, and revoked credentials. Verify session ID rotation after sign-in.

Document HTTPS and RP ID/origin requirements, development setup, user-verification defaults, synced passkeys, and account recovery when a user loses access to their passkeys.

[janhesters]

I opened a draft PR that implements this: #11965

It adds passkey registration and sign-in to remix/auth, browser helpers in a new remix/auth/browser entrypoint, and passkey support in the social-auth demo. Feedback on the API is welcome.