#3628935 - WebAuthn (passkey) Authentication plug-in for Login Flow

Adds a login_flow_webauthn sub-module implementing passkey login (WebAuthn/FIDO2) as a native Login Flow Authentication plug-in. Passkeys coexist with the existing methods The base login_flow module is left untouched — all files under modules/login_flow_webauthn/ and use only public extension points.

What's included

• Authentication plug-in Passkey (WebAuthn) with config: roles, email domains, resident key, user verification, timeout, enroll_after_login, max_per_user (default 5).
• JSON ceremony endpoints (register/, login/, has-passkey, me-status) with flood control; one-shot 10-min challenges, exact-origin check, counter anti-replay; ES256 + RS256 + EdDSA, no forced authenticatorAttachment.
• Login UX: post-username passkey discovery hint (always-200 lookup, no account enumeration), Sign in with passkey button, loading states on all buttons, post-login enrollment modal (once per session, dismissible).
• Self-service (/user/{user}/passkeys, /webauthn/enroll) + admin backoffice (/admin/people/passkeys: filter, dates, single + bulk delete).
• webauthn_credential entity + update hooks; French translations (translations/fr.po, 129 strings); EN/FR READMEs; scripts/run-tests.sh.

Requirements Drupal ^10.6 || ^11, PHP >= 8.2, HTTPS (except localhost), web-auth/webauthn-lib: ^5.3.

Test results scripts/run-tests.sh green. Functional needs a driven browser (CI).

Manual test steps

1. Enable the module, enable/configure the plug-in at /admin/config/system/login_flow.
2. As a user: enroll a key at My account > Passkeys, log out, log in with username → hint → Next → passkey button (no mail sent).
3. Same account without passkey → use next login_flow plugin.
4. As admin: check /admin/people/passkeys (filter, dates, delete).