passwordless login + proper migrations

static/passkey-login.js

@@ -6,31 +6,27 @@ function b64ToBytes(b64) {
 }
 
 document.getElementById("passkey-login").addEventListener("click", async () => {
-  const email = document.getElementById("email").value;
-  if (!email) {
-    alert("Enter your email first.");
-    return;
-  }
+  const email = document.getElementById("email").value.trim();
   const start = await fetch("/auth/passkey/login/start", {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ email }),
   });
   if (!start.ok) {
-    alert("No passkey found for that email.");
+    alert("No passkey found for that account.");
     return;
   }
-  const options = await start.json();
-  const pk = options.publicKey;
+  const data = await start.json();
+  const pk = data.publicKey;
   pk.challenge = b64ToBytes(pk.challenge);
   if (pk.allowCredentials) {
     pk.allowCredentials.forEach((c) => (c.id = b64ToBytes(c.id)));
   }
-  const credential = await navigator.credentials.get(options);
+  const credential = await navigator.credentials.get({ publicKey: pk });
   const finish = await fetch("/auth/passkey/login/finish", {
     method: "POST",
     headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ response: credential }),
+    body: JSON.stringify({ token: data.token, response: credential }),
   });
   if (finish.ok) {
     window.location.href = "/lists";