feat(auth): passkeys as a second factor (#106)

.env.example

@@ -81,6 +81,17 @@ JWT_SECRET=                          # generate with: openssl rand -hex 32
 # not let through, until they use a recovery code or an admin clears their
 # two-factor from the dashboard.
 # TOTP_ENC_KEY=
+#
+# Passkeys as a second factor. Set this to the domain the web portal is
+# served on, or a parent of it: with VOLTIUS_APP_URL=https://app.example.com
+# either app.example.com or example.com works. Unset, the server offers no
+# passkeys. The portal must be reachable over HTTPS at VOLTIUS_APP_URL, since
+# that is where the browser creates and uses them.
+#
+# Passkeys are bound to this value for good: changing it later makes every
+# registered passkey unusable, and their owners fall back to an authenticator
+# code or a recovery code.
+# WEBAUTHN_RP_ID=
 
 
 # Account deletion (optional) ---------------------------------------------