[Phase 2 / Feature B / B-8] E2E spec: passkey authenticator full flow (CDP virtual authenticator + local RP)

[gynet]

Parent: #9. Depends on #49 (B-5). Owner: SDET.

Scope

`e2e/extension/passkey-authenticator.spec.ts` — Playwright + CDP virtual authenticator + local fixture RP (tiny static page that loads a pinned WebAuthn client SDK or hand-rolled `navigator.credentials.create/get` with deterministic challenges).

Assertions

Per design §3.9:

• AC-B1: register → entry created with 13 NKW.Passkey.* fields → public key matches
• AC-B2: sign-in → SignCount +1 → LastUsedDate updated → RP verifies
• AC-B3: RP mismatch rejected pre-vault
• AC-B4: locked vault → unlock → retry completes
• AC-B5: user declines → native authenticator invoked (virtual authenticator as fallback)
• AC-B6: re-open after save → still functional

Notes

• Reference: the existing `e2e/core/passkey-unlock.spec.ts` (Feature A) for CDP virtual authenticator setup patterns
• Must run headless in CI

Acceptance

• Spec added, runs green in CI
• All 6 named assertions pass
• Runtime < 60s
• No flakes across 10 consecutive CI runs