webauthn: stop broadcasting all credentials at login, add discoverable + scoped flow with username-claim gate` #365

Users choose a username at signup (validated, lowercased, unique); it
becomes the WebAuthn display name while user.id stays a random UUID.
Existing placeholder accounts get a one-time claim via GET/POST
/user/username (migration 044 adds username_is_placeholder).

Kill the credential-broadcast leak: /auth/login/begin and qr-login now do
scoped (username) / discoverable (username-less) / broadcast branching, gated
by LOGIN_ALLOW_BROADCAST (default on). Discoverable finish resolves the user
via userHandle; unknown username returns empty allowCredentials (no oracle).
Add username-claim gate middleware, credProps residency capture + resident
column, CLI --username flag, optional frontend username field, and a
deterministic e2e suite (make test-e2e-webauthn).

Gated users' checkAuth() call was itself gated, making them
appear logged-out and bouncing them to the register page
instead of the account/claim-username view.

- cli: require username at register (--username, prompt fallback)
- cli: stop looping on AlreadyClaimed (409) at username claim
- frontend: clone 403 body in authFetch; send clientExtensionResults
- gateway: zero-cred known username takes decoy path (mediation oracle)
- e2e: add register-username-required + already-claimed 409 steps

Thread UsernameScope through AuthState::Discoverable and check it at finish so a decoy/known-zero-cred challenge can't authenticate as a different resident user; UnexpectedCredentialOwner now returns 400 instead of 500. CLI: guard the register username prompt against non-interactive stdin.

Make a username-present /auth/login/begin indistinguishable whether the
username exists with credentials, exists with zero credentials, or does
not exist at all. Before this, a known account with credentials returned
a distinct non-empty allowCredentials list while every other case
returned an empty one, and /auth/login/finish leaked a status oracle
(unknown-user/bad-signature -> 500, decoy/scope reject -> 400). Together
those let an attacker enumerate registered usernames.
Three items land as one change because they are interdependent:
- Normalized finish errors: every credential-verification outcome
 (unknown credential, bad signature, decoy/scope rejection, expired or
 invalid session) collapses to one byte-identical 401
 {"error":"authentication_failed"}. Genuine infrastructure failures keep
 the same body but are logged at error/warn so outages stay visible.
- HMAC-synthesized decoys (new decoy.rs): an unknown or zero-credential
 username gets a deterministic, per-username-stable fake allowCredentials
 list keyed off the existing csrf_secret (domain-separated, no new
 secret to provision). Same shape as the real path -- non-empty list, no
 mediation, UV=Preferred. Synthetic IDs never exist in server state and
 check_username_scope rejects any decoy at finish, so a decoy can never
 complete a ceremony. DB round-trips are equalized across hit/miss; the
 residual per-credential deserialize timing cost is documented as a
 known, out-of-scope limitation.
- Rate limiting: a tighter per-IP budget on scoped begin (hard 429, keyed
 by IP so it leaks nothing about a username) plus a per-username budget
 that degrades to a decoy rather than a 429 (a hard per-username limit
 would let an attacker DoS a real user's login and would itself signal
 that the username is being targeted). In-memory, single-replica; the
 assumption is documented in rate_limit.rs.
Also from self-review: the per-IP scoped limiter is now enforced on the
QR cross-device authenticate path (it was documented as covered but only
wired into the direct begin handler), and the e2e suite asserts the
finish oracle is closed, decoys are byte-stable across probes, a real
user's scoped response still carries their actual credential id (not a
decoy), and the scoped rate limit trips while the no-username path is
unaffected.
Verified: cargo test -p gateway (87/0); e2e login (20/20), software
round-trip, and CDP resident browser all pass on amd64.

Code review of the login-begin timing-equalization fix found two gaps:
the decoy fixture was ES256-only (real RSA credentials cost more to
deserialize) and a broken fixture would fail open silently. Alternate an
RS256 fixture in and validate both at startup instead.