feat: passkey support

[rmad17]

This PR carves the Passkey-only slice out of #116 , which combined Passkey, My Account, and DPoP into one large diff. It's the first of three sequential branches (Passkey → My Account → DPoP), split for merge-conflict legibility — each lands as its own PR instead of one large one.

Refer to #116 for the original review discussion and feedback — the code here was reviewed there; this PR only re-sequences it.

Features

• Passkey sign-in (ServerClient): passkey_signup_challenge,
  passkey_login_challenge, and signin_with_passkey. Call
  passkey_signup_challenge or passkey_login_challenge to get an
  auth_session and WebAuthn options for the browser, then call
  signin_with_passkey with the signed credential to complete sign-in and
  create a session. Uses the urn:okta:params:oauth:grant-type:webauthn
  grant.
• MFA on passkey sign-in and refresh: signin_with_passkey raises
  MfaRequiredError when a second factor is required, before any session
  is created (persist=False path). get_token_by_refresh_token now raises
  the same typed MfaRequiredError via a shared MfaClient._raise_mfa_required
  helper, instead of stuffing mfa_token/mfa_requirements onto an ApiError.
• MfaClient internals hardened alongside this: public MFA methods
  (list_authenticators, enroll_authenticator, challenge_authenticator,
  verify) now decrypt an encrypted mfa_token internally instead of
  requiring the caller to pass a raw token; error-body parsing now falls
  back safely on non-JSON responses instead of raising a raw JSON-decode
  error.

API Changes

• New public methods: ServerClient.passkey_signup_challenge,
  passkey_login_challenge, signin_with_passkey.
• New public models: PasskeyUserProfile, PasskeySignupChallengeResponse,
  PasskeyLoginChallengeResponse, PasskeyAuthResponse,
  PasskeyTokenResponse, PasskeyLoginResult, plus supporting WebAuthn
  option models (PasskeyRpInfo, PasskeyUserInfo, PasskeyPubKeyCredParam,
  PasskeyAuthenticatorSelection, PasskeyPublicKeyOptions).
• New error types: PasskeyError, PasskeyErrorCode. Raised by the three
  ServerClient passkey methods.
• AuthenticatorResponse.authenticator_type and ChallengeResponse.challenge_type
  are now typed str (previously a Literal), so a factor/challenge type
  Auth0 adds later doesn't raise a ValidationError. No change to values
  returned today.

Deprecation

Deprecation (non-breaking): the AuthenticatorType alias still imports
and resolves to its previous Literal["otp", "oob", "recovery-code"], but
now emits a DeprecationWarning on access and is scheduled for removal in
a future major release. It no longer constrains a model field. Existing
imports keep working.

[kishore7snehil]

LGTM!

[kishore7snehil]

LGTM!