fix(passkey): unbreak registration — route mount + localhost gate (#63)

* fix(passkey): mount /api/passkey/register/* at the protected-group root

The two register routes were nested inside r.Route("/settings", ...),
so their effective paths were /settings/api/passkey/register/{begin,finish}.
The frontend (passkey-registration.js and the inline JS in
user_pages.templ) calls /api/passkey/register/begin, matching the public
/api/passkey/login/* routes — and every call 404'd:

    POST http://localhost:3000/api/passkey/register/begin → 404

Move the two register endpoints up one level so they peer with logout and
the root redirect inside the protected group. They still pick up RequireAuth,
RequirePasswordChange, InjectIntegrationStatus, and the 60s timeout from
that group's middleware — auth is enforced by the group, not the URL
prefix. The PasskeyDelete endpoint stays at /settings/profile/passkey/delete
because it's a profile-page action, not a passkey-API call.

Result: passkey URLs are symmetric — /api/passkey/login/* (public) and
/api/passkey/register/* (authenticated).

Closes #44

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(passkey): stop excluding localhost from WebAuthn init

The gate at cmd/server/main.go was

    if cfg.WebAuthnRPID != "" && cfg.WebAuthnRPID != "localhost"

…which meant any dev box running `make dev` (BASE_URL=http://localhost:3000)
got an uninitialized WebAuthn manager, and every passkey registration
attempt 500'd with "WebAuthn not configured."

`localhost` is a valid RPID per the WebAuthn spec (Level 2 §4 / §13.4.8)
and is whitelisted as a secure origin by every browser specifically so
dev installs don't need a TLS cert and a real hostname. The
`go-webauthn/webauthn` library accepts it without complaint.

Surfaced while verifying the routing fix for #44 — the routing change
alone left the same user goal still broken because the handler
shortcuts on a nil manager before doing anything useful.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(passkey): address Copilot review on #63

- Warn at startup if WebAuthn RPID resolved to "localhost" *and* BASE_URL
  was never explicitly set. Without this, an operator who forgot to
  configure BASE_URL in production gets a working-looking Passkey UI that
  fails at registration with an opaque origin-mismatch error from the
  browser. The warning makes the misconfig findable in the journal.

- Set `Cache-Control: no-store` (+ `Pragma: no-cache` for old proxies) on
  the PasskeyRegisterBegin response. The body carries a single-use
  challenge + session_id bound to the requesting user; an intermediary
  cache could surface the same challenge to a different user. The /finish
  handler's per-user session-ID check would reject the cross-user case,
  but defense-in-depth costs two header lines.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sarg3nt

gearbox/cmd/server/main.go

@@ -398,8 +398,10 @@ func main() {
 	}
 	logger.Info("gear system initialized")
 
-	// Initialize WebAuthn for passkey support
-	if cfg.WebAuthnRPID != "" && cfg.WebAuthnRPID != "localhost" {
+	// Initialize WebAuthn for passkey support. `localhost` is a valid RPID
+	// per the WebAuthn spec and is whitelisted as a secure origin by every
+	// browser specifically for dev — don't gate it out.
+	if cfg.WebAuthnRPID != "" {
 		webAuthnCfg := &auth.WebAuthnConfig{
 			RPDisplayName: cfg.WebAuthnRPDisplayName,
 			RPID:          cfg.WebAuthnRPID,
@@ -414,9 +416,20 @@ func main() {
 			logger.Info("WebAuthn initialized",
 				"rp_id", cfg.WebAuthnRPID,
 				"origins", cfg.WebAuthnRPOrigins)
+			// If RPID is "localhost" but BASE_URL was never explicitly set,
+			// the operator probably forgot to configure it. Passkey UI will
+			// render but registration will fail at the authenticator with an
+			// opaque origin-mismatch error — warn loudly so the misconfig is
+			// findable in the journal.
+			if cfg.WebAuthnRPID == "localhost" && os.Getenv("BASE_URL") == "" {
+				logger.Warn("WebAuthn RPID is 'localhost' because BASE_URL is unset — " +
+					"passkey UI will appear, but registration from any non-localhost " +
+					"hostname will fail with an origin-mismatch error. Set BASE_URL " +
+					"(or WEBAUTHN_RP_ID/WEBAUTHN_RP_ORIGINS) in production.")
+			}
 		}
 	} else {
-		logger.Info("WebAuthn disabled (requires BASE_URL with non-localhost domain)")
+		logger.Info("WebAuthn disabled (BASE_URL did not yield a hostname)")
 	}
 
 	// Setup router
@@ -523,6 +536,12 @@ func main() {
 		// (per-user → system → fallback). See feature/dashboard-gear F1.
 		r.Get("/", h.RootRedirect)
 
+		// Passkey registration (authenticated). Mounted at the same /api/passkey
+		// prefix as the public login routes above for URL symmetry; auth is
+		// supplied by this protected group's middleware, not the path.
+		r.Get("/api/passkey/register/begin", h.PasskeyRegisterBegin)
+		r.Post("/api/passkey/register/finish", h.PasskeyRegisterFinish)
+
 		// First-run onboarding (issue #49). Admin-only. The /welcome page
 		// self-redirects to / once onboarding is complete (any box or
 		// system gear enabled), so it's safe to leave reachable.
@@ -544,9 +563,7 @@ func main() {
 			r.Get("/change-password", h.ChangePasswordPage)
 			r.Post("/change-password", h.ChangePasswordPost)
 
-			// Passkey management
-			r.Get("/api/passkey/register/begin", h.PasskeyRegisterBegin)
-			r.Post("/api/passkey/register/finish", h.PasskeyRegisterFinish)
+			// Passkey deletion (still under /settings as a profile sub-action)
 			r.Post("/profile/passkey/delete", h.PasskeyDelete)
 
 			// User management routes (require admin or approve_users permission)

gearbox/internal/framework/handler/passkeys.go

@@ -89,8 +89,11 @@ func (h *Handler) PasskeyRegisterBegin(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Return options to client
+	// Return options to client. The challenge is single-use and bound to
+	// the session ID we just stored — never let an intermediary cache it.
 	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-store")
+	w.Header().Set("Pragma", "no-cache")
 	json.NewEncoder(w).Encode(PasskeyRegisterBeginResponse{ //#nosec G104
 		Options:   options,
 		SessionID: sessionID,