fix: add WebAuthn permissions to Permissions-Policy header (#2482)

## Summary

- Adds `publickey-credentials-create=*` and
`publickey-credentials-get=*` to the `Permissions-Policy` response
header in the keychain's `vercel.json`
- Fixes passkey authentication/registration failing when the keychain is
embedded as an iframe, because the browser was blocking WebAuthn API
calls due to missing permission directives

## Test plan

- [ ] Deploy to preview and verify passkeys work in an iframe-embedded
keychain
- [ ] Verify both passkey registration (create) and authentication (get)
flows succeed
- [ ] Confirm no regression on direct (non-iframe) passkey usage

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: Larkooo

packages/keychain/vercel.json

@@ -17,7 +17,7 @@
         },
         {
           "key": "Permissions-Policy",
-          "value": "camera=(), microphone=(), geolocation=()"
+          "value": "camera=(), microphone=(), geolocation=(), publickey-credentials-create=*, publickey-credentials-get=*"
         }
       ]
     },