Allow explicit local WebAuthn ports

docs/DOGFOOD.md

@@ -49,3 +49,8 @@ application concern belongs in the shared module.
   passkey and replacement code digests. `authrecovery.BeginPasskey` and
   `FinishPasskey` now provide that boundary without creating an authenticated
   session; Gamertan keeps the raw grant only in a short-lived HttpOnly cookie.
+- A portless-only WebAuthn origin rule made an unprivileged local HTTPS
+  exercise impossible even though WebAuthn origins include ports. The passkey
+  service now permits an explicit development port only when applications opt
+  in and the RP ID is `localhost` or reserved `.test`; production origins keep
+  the original portless default.

docs/GETTING_STARTED.md

@@ -26,7 +26,7 @@ The packages are ordinary Go imports. Pin the current preview and verify its
 module checksum:
 
 ```bash
-go get gamertan.com/web/requestmeta@v0.1.0-preview.13
+go get gamertan.com/web/requestmeta@v0.1.0-preview.15
 go mod verify
 ```
 

docs/MODULES.md

@@ -18,7 +18,7 @@ import "gamertan.com/web/requestmeta"
 and request the containing module at an exact version:
 
 ```bash
-go get gamertan.com/web/requestmeta@v0.1.0-preview.13
+go get gamertan.com/web/requestmeta@v0.1.0-preview.15
 ```
 
 Only imported packages are compiled and linked. The packages nevertheless

docs/PASSKEYS.md

@@ -9,6 +9,11 @@ authorization decisions, session cookie, HTML, and local recovery command.
 ## Fixed security policy
 
 - Use an exact HTTPS origin whose hostname equals the relying-party ID.
+- Keep production origins portless. For local development only,
+  `AllowDevelopmentPort` permits one explicit non-default port when the RP ID
+  is exactly `localhost` or beneath the reserved `.test` top-level domain. The
+  configured origin, browser `Origin`, and WebAuthn verifier origin must still
+  match exactly.
 - Reject cross-origin ceremonies.
 - Require discoverable credentials and user verification.
 - Request no attestation conveyance.