Add Passkey / FIDO2 Support as means of MFA

Scope & Context
We are enabling users to register and use passkeys (FIDO2/WebAuthn) for passwordless sign-in and as a second factor in TwentyCRM. The scope covers the login screen, user Security settings (add/list/remove passkeys), and workspace security policies to optionally enforce passkeys, behind a feature flag for staged rollout. Out of scope for this ticket are desktop-native app packaging and non-WebAuthn hardware integrations beyond standard FIDO2 authenticators.

Current behavior
Users cannot register or use passkeys in TwentyCRM. Authentication relies on existing methods (for example, email/password or SSO), and there are no passkey-related options in the UI.

Login screen has no “Sign in with a passkey” option.

Settings → Security has no “Passkeys” section to add or manage credentials.

Workspace → Security/Policies has no passkey enable/require toggles.

Mobile web/PWA flows do not expose any WebAuthn prompts or passkey actions.