feat(passkeys): Add passkey manager functions

[vpomerleau]

Because

• The passkey routes need a service layer to enforce business rules before touching the database

This pull request

• Implements PasskeyManager with the full passkey lifecycle: register, post-auth update, list, rename, delete, and bulk delete
• Adds name validation (empty/whitespace/too long) with PasskeyInvalidNameError (errno 229)
• Tightens updatePasskeyName to match on both uid and credentialId, preventing cross-user renames
• Adds lockAccountForPasskeyOperation and isMysqlDupEntry helpers to the repository layer
• Guards maxPasskeysPerUser config with @min(1) to prevent accidentally disabling registration
• Adds unit and integration tests for the manager

Issue that this pull request solves

Closes: FXA-13064

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

Any other information that is important to this pull request.

[dschom]

R+WC. Looks good overall. I do have a couple concerns around the replay attack implementation and what I think might end up being a race condition. Feel free to turn those into fast follows, if you want to unblock the jira ticket.