feat: add authentication routes with session login, WebAuthn, and credential management

Implement Phase 4 auth routes: password login/logout, WebAuthn
registration and authentication, magic link registration, and
credential management pages with HTMX. Includes session middleware,
Jinja2 templates, vendored HTMX, and last-credential guardrails.

120 tests passing.

pyproject.toml

@@ -17,6 +17,7 @@ dependencies = [
     "proquint>=0.2",
     "python-multipart>=0.0.20",
     "httpx>=0.28",
+    "itsdangerous>=2.2.0",
 ]
 
 [project.scripts]