feat: WebAuthn and TOTP 2FA support for admin interface

[mvasl]

Added a 2-factor authentication feature via TOTP-based verification codes and passkeys support via WebAuthn for the admin panel.

WebUI part is mostly generated via Qwen3.6 since I'm not familiar with jquery, please don't kick me too hard if it is bad in some way.

[tobychui]

Hi @mvasl

AI generated code is fine but I don't think 2FA shall be supported in the admin interface in the first place.
My point is:

1. The admin interface shall not be setup in a way that it is accessible from the internet. It should only be accessible within LAN or within a trusted network (access via private VPN, tailscale or zerotier network for example)
2. For multi-user use case, you should add Zoraxy auth as a proper authentication provider (e.g. point zoraxy.example.com to 127.0.0.1:8000 and add Zoraxy auth TOTP 2FA to it, optionally running Zoraxy in "no auth" mode so you dont login twice)

So for case 1, you dont need 2FA and for case 2, Zoraxy auth have TOTP 2FA build-in already. So this feature seems redundant. .

[mvasl]

Well, case 1 is not always true, since many people (including me) prefer to organize their systems in zero-trust manner rather than building guarded perimeters, 2FA starts to make sense if you look at it like that.

[mvasl]

Also, if you think about it, case 2 also makes no sense without privilege separation.

Every one allowed to login is in full control and can edit Zoraxy Auth users, overtake the whole system, it's no better that sharing single user+password pair, but thats offtopic in this PR.

[mvasl]

Added passkeys support with discoverable credentials via WebAuthn as well.

[tobychui]

Sounds cool, let me know when you are done changing stuffs (or convert it to Draft for now if you still plan to make changes in the following week). After finish, please provide a few screenshots on the new login UI and setup page (webmin panel). This will greatly help with the workflow when I am integrating the v3.3.5-rc1 new features next month.

[mvasl]

Sounds cool, let me know when you are done changing stuffs (or convert it to Draft for now if you still plan to make changes in the following week).

The only change i plan is to add rate-limiting via bluemonday to the webauthn "begin" endpoint. It is not strictly needed, more like a safeguard.

UI screenshots:

[mvasl]

@tobychui I think i'm done here. Can you please take a look?

[tobychui]

This is a huge change, maybe next weekend.

Btw, what qwen parameter size you are using here? I think you need at least qwen3.6 35B to generate code with decent quality, so if it is generated using a model smaller than that I guess I might need to ask Claude for a advance review.

[mvasl]

It was Qwen3.6 MoE model with 35B parameters, yes, but only the frontend is generated. I asked both qwen and gemma4 26B to review this as well, but findings were, lets just say hit or miss.

[tobychui]

Ok no problem 👍🏻
Also, maybe you could try to cleanup the PR a bit, I just have a quick look at the changed files, it seems you have accidentally commited a agent config file or something like that. Will have a detail look next weekend.

[mvasl]

Yeah, looks like I accidentally committed some of my Zed debugger dotfiles, dropped it and squashed the commits.