Only show sign-in options that are set up, and fix login buttons

[kaareal]

Summary

The Security settings page showed passkey, Google and Apple options even when they weren't set up, and clicking the passkey button on the login page made the email and password fields go red. This PR fixes both and turns passkeys on by default.

Changes

Security settings page

• The "Add Passkey" button only appears when passkeys are turned on and the browser supports them.
• If passkeys are off and the user has none, the whole Passkey card is hidden. Users who already have passkeys still see them, so they can delete them.
• Google and Apple only appear when they're set up for the app, or when the user has already connected them (so they can disconnect).
• If neither Google nor Apple applies, the "Sign-in with" card is hidden.
• Error messages now show at the top of the page instead of inside the "Sign-in with" card, so they're still visible when that card is hidden.

Login page

• Clicking the passkey, Google or Apple button no longer submits the login form, so the email and password fields no longer turn red with "required".
• The passkey button is also hidden in browsers that don't support passkeys.

Config

• Passkeys are on by default (AUTH_PASSKEY=true in services/web/.env).

Notes for reviewers

• To turn passkeys off, leave AUTH_PASSKEY empty. Setting it to false won't work because any value counts as on.
• This only changes the web app. The API still accepts passkey requests even when AUTH_PASSKEY is off.
• Tested in the browser: the passkey button shows on the login page, and clicking it no longer turns the fields red. Linting hasn't been run.