Add passkey authentication support

[lazerusrm]

Summary

Adds WebAuthn passkeys as a first-class sign-in method while keeping TOTP available as a fallback.

The backend now supports passkey registration, passkey sign-in, passkey reauthentication, and mobile handoff flows. It also adds user and admin management endpoints for listing, renaming, deleting, and resetting passkeys.

Companion frontend PR: amidaware/tacticalrmm-web#55

Security details

• Stores passkey credentials with sign counters, transports, timestamps, and audit metadata.
• Verifies origin, RP ID, challenge state, user verification policy, and credential sign count.
• Consumes login, registration, reauthentication, and mobile challenges after use.
• Rejects stale, malformed, replayed, or cross-user challenge attempts.
• Removes passkeys when a user is deleted or when passkeys are explicitly reset.
• Leaves TOTP available when passkeys are removed, so recovery does not depend on a passkey.

Operational details

• Adds the accounts.0043_webauthn_credentials migration.
• Adds reset_passkeys for command-line passkey removal.
• Extends the existing reset_2fa command so a full MFA reset also removes passkeys.
• Pins test-only dependency ranges that otherwise allow newer packages to replace the production Django and cryptography versions during test setup.

Validation

• Ran Django migration checks and applied the new migration on an upgraded Tactical RMM 1.5.1 validation VM.
• Ran targeted backend tests for passkey registration, sign-in, reauthentication, mobile challenge handling, replay protection, admin reset, user delete cleanup, and TOTP fallback: 44 passed.
• Ran Python compile checks on the touched backend modules.
• Ran manage.py check and pip check on the validation VM and the deployed installation.
• Smoked the deployed API through nginx and confirmed the passkey endpoint returns a controlled error for a request without pre-MFA session state.

[CLAassistant]

All committers have signed the CLA.

[lazerusrm]

I have wanted this feature as i have implemented it across other private software i maintain,

I tested this as much as possible and have been running it with the latest version in my production enviornment.

It is nice to have passkeys, works great for biometric auth on mac! :)

Let me know if i have something wrong and i will address it.

-Brad