feat(webauthn): enforce per-device credential policy and document hybrid auth flow (SRV-046, SRV-047, SRV-048) - S11

[Dmong04]

Closes #33

PR title

feat(webauthn): enforce per-device credential policy and document hybrid auth flow (SRV-046, SRV-047, SRV-048)

---

Description

Implements the S11 WebAuthn hardening deliverable: per-device credential limit policy, supporting DTOs and constants, e2e/unit test coverage with mocks, and documentation of the hybrid Supabase + WebAuthn authorization flow in ARCHITECTURE.

Type of change

• New feature (feat)
• Bug fix (fix)
• Refactor / internal improvement
• Database migration (Prisma)
• Documentation
• Tests
• Other:

Changes made

• src/webauthn/webauthn.constants.ts — new constants for the per-device credential policy (SRV-046).
• src/webauthn/webauthn.service.ts — enforces the credential limit and last-credential protection; updated unit tests in webauthn.service.spec.ts.
• src/webauthn/webauthn.repository.ts — repository support for the new credential policy checks.
• src/webauthn/webauthn.controller.ts — exposes the updated registration/credential routes with the new error codes.
• src/webauthn/dto/registration-response.dto.ts, webauthn-credential.dto.ts, dto/index.ts — DTOs for the credential list and registration response shapes.
• test/webauthn-payments.e2e-spec.ts — e2e coverage for the full WebAuthn + payments authorize HTTP surface, run against the real Supabase auth guard (SRV-047).
• docs/architecture.md — documents the hybrid Supabase + WebAuthn authorization flow (SRV-048).

Test plan

• npx jest --config ./test/jest-e2e.json webauthn-payments — 15/15 passing
• Unit / e2e tests updated or added
• Tested locally with npm run start:dev (or the relevant command)

Migrations / database

N/A

Checklist

• I included Closes # with the correct issue number
• Code follows project conventions (NestJS, modules, etc.)
• npm run lint and npm run test pass without errors
• Prisma migrations generated and tested (if applicable)
• Updated documentation if the change requires it