auth: publish passkey foundations preview

docs/ARCHITECTURE.md

@@ -9,6 +9,8 @@ analytics ──> requestlog ──> requestmeta
 abuse ─────────────────────> requestmeta
 authhttp ──> websec ───────> requestmeta
 authhttp ──> auth <───────── authsqlite
+    │          ▲                 ▲
+    └──> authwebauthn ───────────┘
 organizations <───────────── authsqlite
 access <──────────────────── authsqlite
 ```
@@ -27,6 +29,12 @@ access resolves roles against that hierarchy. Existing `auth` roles remain a
 platform-level compatibility surface and do not implicitly grant access to an
 organization's data. Emergency access is a separate, expiring, audited grant.
 
+`authwebauthn` owns relying-party policy and ceremony orchestration but not
+application routes. It stores only opaque token digests, bounded verifier
+session state, credential public records, and audit metadata through an
+interface implemented by `authsqlite`. The existing `auth` service issues the
+ordinary opaque session only after the passkey verifier succeeds.
+
 The package model is developed from explicit threat and data contracts, not by
 moving an existing application's internals into a shared directory. See
 [ADOPTION.md](ADOPTION.md), [GETTING_STARTED.md](GETTING_STARTED.md), and the