fix(passkey): resolve Backup Eligible flag inconsistency on login (#2…

[guptamilind0099]

Fix passkey verification failure when an authenticator's Backup Eligible (BE) flag changes between registration and authentication. This issue affected Apple iCloud Keychain passkeys where BE is false during initial registration before iCloud sync completes, and flips to true during subsequent logins.

• Update newWebAuthnUserWithAssertion to align cred.Flags.BackupEligible with incoming assertion data for matching credentials.
• Add UpdateLastUsedWithSignCountAndFlags to persist updated sign count, backup eligibility, and backup state in webauthn_credentials.
• Add unit tests verifying Backup Eligible flag synchronization.

Fixes #2732

What kind of change does this PR introduce?

Bug fix.

What is the current behavior?

POST /passkeys/authentication/verify rejects valid WebAuthn assertions when an authenticator's Backup Eligible (BE) flag differs between registration and a later authentication ceremony.

The client receives a generic webauthn_verification_failed (HTTP 400), while the GoTrue server log records:
"Backup Eligible flag inconsistency detected during login validation"

This breaks passkey login for Apple iCloud Keychain passkeys (and other synced passkey authenticators) when a passkey registered prior to iCloud Keychain sync completion (where BE = false) is used for authentication after sync activates (BE = true).

Fixes #2732

What is the new behavior?

1. newWebAuthnUserWithAssertion in internal/api/passkey_webauthn.go synchronizes cred.Flags.BackupEligible on candidate credentials matching the incoming assertion's RawID. This allows go-webauthn's signature, challenge, origin, and counter verification to proceed without failing on strict immutability checks when BE flips post-registration.
2. Upon successful authentication, UpdateLastUsedWithSignCountAndFlags in internal/models/webauthn_credential.go persists the updated backup_eligible and backed_up flags from the authenticator into the webauthn_credentials database record.
3. Passkey login for synced credentials succeeds seamlessly on subsequent logins.

Additional context

• W3C WebAuthn Level 3 specifications and other WebAuthn server implementations (e.g. @simplewebauthn/server) treat BackupEligible and BackupState flags as dynamic authenticator properties that can evolve post-registration rather than immutable attributes.
• Fully backward compatible: no DB schema migrations required, no client API contract changes, and non-synced authenticators (e.g. YubiKeys with fixed BE = false) are unaffected.