fix(passkey): accept signed origin under a per-client RP-ID suffix

[windischb]

The bug (amZettel prod blocker)

A per-client WebAuthn RP-ID is meant to be a registrable suffix of the app origin — RP-ID amzettel.at for a page on https://app.amzettel.at. modgud derived the accepted FIDO2 origin as https://{rpId}, so the browser's real origin (https://app.amzettel.at) was not in the allow-list and MakeNewCredential / MakeAssertion threw → 400 "Passkey enrollment failed." (the native login assertion failed identically). Only reproduces when RP-ID ≠ app host (dev has them equal, so it was invisible).

Root cause: RealmFido2.BuildConfiguration — origins.Add($"https://{host}") with host == rpIdOverride. The RP-ID hash check passes; only the origin collides.

The fix (spec-aligned, Approach A)

Accept the origin the authenticator actually signed (read from clientDataJSON) when it is the RP-ID host or a subdomain of it — exactly the set WebAuthn already scopes to that RP-ID — instead of only https://{rpId}. The RP-ID hash + signature remain the primary boundary; this only widens the origin allow-list to legitimate callers and rejects look-alikes (amzettel.at.evil.com, evilamzettel.at).

No new admin config. Any origin a browser can present for an RP-ID is already under it, so a server-to-server client with empty AllowedCorsOrigins (like amzettel-web) works too — which is why this is preferred over the per-client allow-list option in the report.

Changes:

• RealmFido2.BuildConfiguration gains additionalOrigins (filtered via new IsOriginUnderRpId) + TryGetClientDataOrigin; RealmScopedFido2Factory.CreateAsync threads it.
• Native enroll-finish + native login-assertion read the signed origin and pass it. Web cookie register/login pass nothing → bit-identical.
• DX: the enroll-finish catch now LogWarning(ex, …) so an origin mismatch is diagnosable instead of a reasonless 400.

Tests

• RealmFido2Tests (15) — suffix filter accept/reject incl. look-alikes, origin extraction, BuildConfiguration add/no-add.
• End-to-end enroll from a subdomain origin (https://sub.a.localhost under RP-ID a.localhost) → 200.
• Full CocoarPasskeyGrantFlowTests (24) + web cookie passkey login green; full solution builds 0 errors.

🤖 Generated with Claude Code