feat(server): passkey pre-refactor (#15060)

#### PR Dependency Tree


* **PR #15060** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* OpenApp native sign-in and native session exchange (JWT) for mobile &
desktop.
  * Centralized short-lived auth challenge store for one-time tokens.
* Encrypted per-endpoint token storage and native token handlers
(Android, iOS, Electron).

* **Improvements**
* Richer auth-method reporting (password, magic link, OAuth, passkey)
and improved sign-in flows.
* Hardened magic-link, OAuth, and session issuance; JWT-backed sessions
and websocket JWT support.
* UX tweaks: form-based password submit, OTP autocomplete, adjusted
captcha flow.

* **Bug Fixes**
  * Expanded tests and auth-state resets to avoid cross-test leakage.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/frontend/apps/android/src/app.tsx

@@ -57,7 +57,11 @@ import { Auth } from './plugins/auth';
 import { HashCash } from './plugins/hashcash';
 import { NbStoreNativeDBApis } from './plugins/nbstore';
 import { Preview } from './plugins/preview';
-import { writeEndpointToken } from './proxy';
+import {
+  deleteEndpointToken,
+  readEndpointToken,
+  writeEndpointToken,
+} from './proxy';
 
 const storeManagerClient = createStoreManagerClient();
 setTelemetryTransport(storeManagerClient.telemetry);
@@ -206,10 +210,20 @@ framework.scope(ServerScope).override(AuthProvider, resolver => {
       });
       await writeEndpointToken(endpoint, token);
     },
-    async signOut() {
-      await Auth.signOut({
+    async signInOpenAppSignInCode(code) {
+      const { token } = await Auth.signInOpenApp({
         endpoint,
+        code,
       });
+      await writeEndpointToken(endpoint, token);
+    },
+    async signOut() {
+      const token = await readEndpointToken(endpoint);
+      try {
+        await Auth.signOut({ endpoint, token });
+      } finally {
+        await deleteEndpointToken(endpoint);
+      }
     },
   };
 });
@@ -442,5 +456,20 @@ function createStoreManagerClient() {
     },
     [nativeDBApiChannelClient]
   );
+
+  const { port1: authTokenChannelServer, port2: authTokenChannelClient } =
+    new MessageChannel();
+  authTokenChannelServer.addEventListener('message', event => {
+    const { id, endpoint } = event.data as { id?: string; endpoint?: string };
+    if (!id || !endpoint) return;
+    readEndpointToken(endpoint)
+      .then(token => authTokenChannelServer.postMessage({ id, token }))
+      .catch(() => authTokenChannelServer.postMessage({ id, token: null }));
+  });
+  authTokenChannelServer.start();
+  worker.postMessage(
+    { type: 'native-auth-token-channel', port: authTokenChannelClient },
+    [authTokenChannelClient]
+  );
   return new StoreManagerClient(new OpClient(worker));
 }