Passkeys: one-time invite codes to enrol another device

A signed-in device creates a short-lived, single-use code in Settings
("Invite a device"); the new device enters it on the sign-in page to create
its own passkey. Codes are throttled like other secrets and cannot be used
by signed-out clients to create more codes.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

public/webauthn.js

@@ -9,8 +9,8 @@ async function authPost(path, body, method = 'POST') {
   if (!r.ok) throw new Error(j.error || 'Request failed (' + r.status + ')');
   return j;
 }
-async function passkeyRegister(setupCode, name) {
-  const { cid, options } = await authPost('/api/auth/register/options', { setupCode });
+async function passkeyRegister(setupCode, name, inviteCode) {
+  const { cid, options } = await authPost('/api/auth/register/options', { setupCode, inviteCode });
   options.challenge = b64u.dec(options.challenge);
   options.user.id = b64u.dec(options.user.id);
   (options.excludeCredentials || []).forEach(c => { c.id = b64u.dec(c.id); });