Hermes WebUI < 0.51.409 - Unauthenticated Passkey Registration via Authentication Bypass

An unauthenticated remote attacker sends POST requests to `/api/auth/passkey/register/options` and `/api/auth/passkey/register` while the `HERMES_WEBUI_PASSKEY=1` feature flag is enabled and no credentials have been configured. Because the server does not require authentication for these endpoints when no password hash exists, the attacker can complete the WebAuthn registration flow and claim the first passkey, thereby gaining permanent administrative control over the Hermes WebUI instance. The patch introduces a check that rejects remote (non-loopback) client addresses during this bootstrap phase, and requires a valid session when authentication is already enabled [ref_id=1].

The commit adds new test cases and corresponding logic to enforce authentication on the passkey registration endpoints. Specifically, when no password hash exists (first-time setup), the server now allows registration only from a loopback client address (`127.0.0.1`), preventing remote attackers from bootstrapping a passkey. When authentication is already enabled, the endpoints require a valid session cookie verified via `verify_session`. These changes close the bypass by ensuring that passkey enrollment is never accessible to unauthenticated remote callers [patch_id=6466844].