refactor: split auth router into focused modules

Split the 429-line auth.py into three modules for better maintainability:
- auth.py (264 lines): core auth, login, token refresh, RBAC, preferences
- passkey.py (187 lines): WebAuthn passkey registration and authentication
- totp.py (41 lines): TOTP 2FA setup and verification

All 21 endpoints maintain backward compatibility under /api/auth prefix.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

dashboard/backend/main.py

@@ -5,7 +5,7 @@ from fastapi.responses import JSONResponse
 from slowapi import Limiter
 from slowapi.util import get_remote_address
 from slowapi.errors import RateLimitExceeded
-from routers import docker_router, gitea, files, terminal, system, auth, chat_summary, security
+from routers import docker_router, gitea, files, terminal, system, auth, chat_summary, security, passkey, totp
 import auth as auth_module
 from rbac import require_page, require_write
 
@@ -147,6 +147,8 @@ async def _inject_user(request: Request, user = Depends(auth_module.get_current_
 
 # Public auth endpoints
 app.include_router(auth.router, prefix="/api/auth", tags=["auth"])
+app.include_router(passkey.router, prefix="/api/auth", tags=["passkey"])
+app.include_router(totp.router, prefix="/api/auth", tags=["totp"])
 
 # Protected endpoints with page-level RBAC
 app.include_router(docker_router.router, prefix="/api/docker",