feat(server): passkey pre-refactor (#15060)

#### PR Dependency Tree


* **PR #15060** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* OpenApp native sign-in and native session exchange (JWT) for mobile &
desktop.
  * Centralized short-lived auth challenge store for one-time tokens.
* Encrypted per-endpoint token storage and native token handlers
(Android, iOS, Electron).

* **Improvements**
* Richer auth-method reporting (password, magic link, OAuth, passkey)
and improved sign-in flows.
* Hardened magic-link, OAuth, and session issuance; JWT-backed sessions
and websocket JWT support.
* UX tweaks: form-based password submit, OTP autocomplete, adjusted
captcha flow.

* **Bug Fixes**
  * Expanded tests and auth-state resets to avoid cross-test leakage.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/frontend/apps/ios/src/nbstore.worker.ts

@@ -18,19 +18,28 @@ import {
 import { type MessageCommunicapable, OpConsumer } from '@toeverything/infra/op';
 import { AsyncCall } from 'async-call-rpc';
 
-import { readEndpointToken } from './proxy';
+let authTokenPort: MessagePort | undefined;
+const pendingTokenRequests = new Map<string, (token: string | null) => void>();
 
 configureSocketAuthMethod((endpoint, cb) => {
   readEndpointToken(endpoint)
-    .then(token => {
-      cb({ token });
-    })
-    .catch(e => {
-      console.error(e);
-    });
+    .then(token => cb(token ? { token, tokenType: 'jwt' } : {}))
+    .catch(() => cb({}));
 });
 
 globalThis.addEventListener('message', e => {
+  if (e.data.type === 'native-auth-token-channel') {
+    authTokenPort = e.ports[0] as MessagePort;
+    authTokenPort.addEventListener('message', e => {
+      const { id, token } = e.data as { id?: string; token?: string | null };
+      if (!id) return;
+      pendingTokenRequests.get(id)?.(token ?? null);
+      pendingTokenRequests.delete(id);
+    });
+    authTokenPort.start();
+    return;
+  }
+
   if (e.data.type === 'native-db-api-channel') {
     const port = e.ports[0] as MessagePort;
     const rpc = AsyncCall<NativeDBApis>(
@@ -57,6 +66,25 @@ globalThis.addEventListener('message', e => {
   }
 });
 
+function readEndpointToken(endpoint: string) {
+  if (!authTokenPort) {
+    return Promise.resolve(null);
+  }
+
+  const id = `${Date.now()}:${Math.random()}`;
+  return new Promise<string | null>(resolve => {
+    const timeout = setTimeout(() => {
+      pendingTokenRequests.delete(id);
+      resolve(null);
+    }, 5000);
+    pendingTokenRequests.set(id, token => {
+      clearTimeout(timeout);
+      resolve(token);
+    });
+    authTokenPort?.postMessage({ id, endpoint });
+  });
+}
+
 const consumer = new OpConsumer<WorkerManagerOps>(
   globalThis as MessageCommunicapable
 );