fix(auth): add admin passkey toggle

[intel352]

Summary

• add passkey_auth_enabled/passkey_enabled policy inputs so passkeys can be disabled without clearing WebAuthn RP config
• expose passkey_auth_enabled in the reusable admin auth config controls
• extend strict proto contracts and regressions

Verification

• GOWORK=off go test ./... -count=1
• GOWORK=off go vet ./...
• wfctl plugin validate --file plugin.json --strict-contracts
• PLUGIN_MANIFEST_EXPECT_VERSION=0.0.0 GOWORK=off go test ./internal -run TestIntegration_PluginManifestAndStepTypes -count=1

[Copilot]

Pull request overview

Adds an explicit admin/policy toggle to disable passkey authentication without requiring WebAuthn relying party configuration to be cleared, and extends the plugin’s strict proto contracts to include the new inputs.

Changes:

• Add passkey_auth_enabled / passkey_enabled inputs and treat strict false as a hard disable for passkeys (while still requiring RP config to be present to enable).
• Expose passkey_auth_enabled as an admin config control and skip RP validation when passkeys are explicitly disabled.
• Extend protobuf contracts (and generated code) and add/update regression tests and changelog entry.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/step_methods_policy.go	Adds passkey “configured vs enabled” split and introduces strict-false parsing helpers.
internal/step_methods_policy_test.go	Adds regression coverage for disabling passkeys (needs additional cases per review).
internal/step_admin_config.go	Exposes passkey toggle in admin controls and bypasses RP validation when disabled.
internal/step_admin_config_test.go	Updates admin describe test to include/verify the new toggle control.
internal/contracts/auth.proto	Adds optional proto fields for passkey toggle inputs/config.
internal/contracts/auth.pb.go	Regenerates Go bindings for the updated proto contracts.
CHANGELOG.md	Documents the new passkey toggle behavior.

Files not reviewed (1)

• internal/contracts/auth.pb.go: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.