fix(passkey): address Copilot review on #63

- Warn at startup if WebAuthn RPID resolved to "localhost" *and* BASE_URL
  was never explicitly set. Without this, an operator who forgot to
  configure BASE_URL in production gets a working-looking Passkey UI that
  fails at registration with an opaque origin-mismatch error from the
  browser. The warning makes the misconfig findable in the journal.

- Set `Cache-Control: no-store` (+ `Pragma: no-cache` for old proxies) on
  the PasskeyRegisterBegin response. The body carries a single-use
  challenge + session_id bound to the requesting user; an intermediary
  cache could surface the same challenge to a different user. The /finish
  handler's per-user session-ID check would reject the cross-user case,
  but defense-in-depth costs two header lines.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sarg3nt

gearbox/cmd/server/main.go

@@ -416,6 +416,17 @@ func main() {
 			logger.Info("WebAuthn initialized",
 				"rp_id", cfg.WebAuthnRPID,
 				"origins", cfg.WebAuthnRPOrigins)
+			// If RPID is "localhost" but BASE_URL was never explicitly set,
+			// the operator probably forgot to configure it. Passkey UI will
+			// render but registration will fail at the authenticator with an
+			// opaque origin-mismatch error — warn loudly so the misconfig is
+			// findable in the journal.
+			if cfg.WebAuthnRPID == "localhost" && os.Getenv("BASE_URL") == "" {
+				logger.Warn("WebAuthn RPID is 'localhost' because BASE_URL is unset — " +
+					"passkey UI will appear, but registration from any non-localhost " +
+					"hostname will fail with an origin-mismatch error. Set BASE_URL " +
+					"(or WEBAUTHN_RP_ID/WEBAUTHN_RP_ORIGINS) in production.")
+			}
 		}
 	} else {
 		logger.Info("WebAuthn disabled (BASE_URL did not yield a hostname)")

gearbox/internal/framework/handler/passkeys.go

@@ -89,8 +89,11 @@ func (h *Handler) PasskeyRegisterBegin(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Return options to client
+	// Return options to client. The challenge is single-use and bound to
+	// the session ID we just stored — never let an intermediary cache it.
 	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-store")
+	w.Header().Set("Pragma", "no-cache")
 	json.NewEncoder(w).Encode(PasskeyRegisterBeginResponse{ //#nosec G104
 		Options:   options,
 		SessionID: sessionID,