[Feature Request] Passkey / WebAuthn support

Description Summary Paperless-ngx supports TOTP two-factor auth today. I'd like to propose adding WebAuthn support on top of that, in two parts: 1. Security keys / passkeys as a second factor 2. Passwordless passkey login These are independent switches in allauth, so they could land separately. TOTP works, but it's the weakest of the common second factors. Passkeys are phishing-resistant, built into every current OS and browser, and nicer to live with than typing a six-digit code. I dug into the current auth setup, and a lot of the groundwork is already in place: • django-allauth[mfa] is already a dependency, and fido2 is already resolved in uv.lock, so this needs no new dependency. • allauth ships the entire WebAuthn implementation: views, forms, URL patterns, and the client-side JS. • allauth.headless.urls is already mounted at /api/auth/headless/. Once WebAuthn is in MFA_SUPPORTED_TYPES, the headless endpoints for registering and ma…