feat(nixpak): pass FIDO2 keys to Firefox, Chromium and Chrome (#515)

* feat(nixpak): pass FIDO2 keys to Firefox, Chromium and Chrome

Assisted-by: DeepSeek Harness (deepseek-flash)

* feat(nixpak): support FIDO2 hotplug via udev-maintained node directory

Replace launch-time hidraw discovery with host udev rules that hard-link
FIDO-tagged hidraw nodes into /dev/fido-hidraw and remove them on unplug.
The sandbox dev-binds that directory and gets static /dev/hidrawN symlinks
into it, so keys plugged in after launch work and no stale node survives a
reused hidraw minor.

Narrow the extra mounts from whole /sys and /run/udev to /sys/class/hidraw,
/run/udev/data and /run/udev/control; the policy suite now forbids the
broad mounts and checks the wrapper and bind follow the fido2 option.

Assisted-by: Claude Code (claude-opus-5-5)

* refactor(nixpak): rewrite FIDO2 bwrap wrapper in Python

The bash argument loop was hard to follow. Python inserts the /dev/hidrawN
symlinks before "--" with a single list splice, and the header now explains
the whole host-udev -> bind -> symlink chain step by step.

Assisted-by: Claude Code (claude-opus-5-5)

* docs(canokey): document phone-only management policy

PCs only use the CanoKey; CanoKey Console management stays in the phone
app and the Admin PIN is never typed on a PC. Record what the config
enforces (sandboxed browsers get no raw USB/CCID, no vendor WebUSB udev
rule) and what it does not (uaccess on the raw USB node, PC/SC access to
the Admin applet, CTAP management from browsers).

Assisted-by: Claude Code (claude-opus-5-5)

* docs(canokey): separate management from use, link CanoKey docs

Assisted-by: Claude Code (claude-opus-5-5)

* fix(nixpak): create /dev/fido-hidraw from the udev rule

NixOS applies /dev tmpfiles entries only at boot; switch-to-configuration
runs systemd-tmpfiles-resetup with --exclude-prefix=/dev. After a switch
without reboot the directory was missing and every `ln` failed with exit
code 1, so no browser saw the key. The add rule now runs `mkdir -p` first.

Also fix the documented trigger command: `udevadm trigger` defaults to
`change`, which the add-only rule ignores.

Assisted-by: Claude Code (claude-opus-5-5)

* refactor(nixpak): keep tmpfiles as the only creator of /dev/fido-hidraw

The /dev tmpfiles units run before systemd-udevd on every boot, so the
directory always exists before coldplug. The mkdir in the udev rule only
covered the first switch without reboot and duplicated the tmpfiles rule;
drop it and document the one-time `systemd-tmpfiles --prefix` command.

Assisted-by: Claude Code (claude-opus-5-5)

* docs(nixpak): record FIDO2 hardware validation in Firefox and Chrome

After a reboot on ai with the CanoKey present at boot, udev linked only
the FIDO interface and WebAuthn works in Firefox and Chrome. Chromium and
plugging the key in after launch remain pending.

Assisted-by: Claude Code (claude-opus-5-5)

docs/SECURITY.md

@@ -332,6 +332,13 @@ isolation. Source review and socket metadata—not reads of private credentials
   Browser media and browserpass are enabled only for Firefox/Chromium/Chrome. Brave Origin and Edge
   are backup browsers with no media grants. browserpass exposes password-store/GPG data and agent
   operations.
+- Firefox/Chromium/Chrome receive FIDO2 security-key passthrough for WebAuthn/passkeys. Host udev
+  rules hard-link only FIDO-tagged hidraw nodes into `/dev/fido-hidraw` and remove them on unplug;
+  the sandbox binds that directory plus read-only `/sys/class/hidraw` and the udev database. The
+  CanoKey KBD and CCID interfaces, other HID devices and raw USB stay outside the sandbox; Brave
+  Origin and Edge receive no FIDO2 passthrough. A compromised browser can use the key's FIDO
+  interface; the key's PIN and touch policy remain the authentication boundary. Hotplug works for
+  host-network Firefox/Chromium; pasta-isolated Chrome needs the key present at launch.
 - Nixpak supplements Chromium's renderer sandbox, which remains enabled. Zoom/WeChat retain their
   FHS runtimes inside the outer boundary; inner mounts cannot recover hidden host resources.
 - Desktop access has limits: GPU drivers remain exposed, PulseAudio permits recording, read-only
@@ -348,8 +355,9 @@ isolation. Source review and socket metadata—not reads of private credentials
 - Policy/build passes for all nine wrappers. Interactive validation passed for Firefox, Chrome,
   Chromium, Brave Origin, Edge, QQ, Telegram and Zoom; the Chromium smoke test also validates
   renderer sandboxing, environment clearing, bind scope and profile persistence. WeChat's
-  interactive Wayland check remains pending. See the
-  [runtime validation](../hardening/tests/runtime-validation.md).
+  interactive Wayland check remains pending. FIDO2 browser passthrough passed WebAuthn with the
+  CanoKey in Firefox and Chrome; Chromium and plugging the key in after launch still need
+  validation. See the [runtime validation](../hardening/tests/runtime-validation.md).
 
 #### Agent-first diagnostics by host role