passwordless login + proper migrations

src/domain.rs

@@ -19,6 +19,10 @@ pub struct User {
     pub id: i64,
     pub email: String,
     pub display_name: String,
+    /// Opaque, random user handle used as the WebAuthn userHandle. Kept
+    /// high-entropy and unpredictable per the WebAuthn spec to avoid user
+    /// enumeration and cross-site correlation. Stored as raw bytes.
+    pub user_handle: Vec<u8>,
 }
 
 #[derive(Clone, Debug)]