Manual E2E: real authenticator for assurance + WebAuthn paths

Problem/Motivation

1.3.0 ships high-assurance plain-link (OIDC step-up + FG_AB bridge) and native WebAuthn RP mode. Kernel tests cover contracts (challenge, bridge, invalid tokens, grant HMAC). Full browser + hardware ceremonies are not in CI (normal for WebAuthn/PIV).

GitHub: Wilkes-Liberty/file_gate#37 (implementation / checklist work happens there; this issue is the public dual-venue record).

Proposed resolution

A repeatable manual E2E checklist (and optional automated browser suite later) that proves:

1. OIDC redeem + bridge: mint → open plain URL → IdP step-up (FIDO or PIV via IdP) → bridge cookie → file streams; max_uses / TTL behave.
2. Native WebAuthn: register credential → mint (with subject) → plain URL → authenticator touch → assert → bridge → download.
3. Failure modes: wrong acr, spent one-time link, expired grant, missing credentials, wrong wh/sh.
4. DPoP (if enabled): stolen bearer without proof fails; with proof succeeds.
5. Edge mTLS (if available in lab): client_cert mode with trusted proxy header.

Remaining tasks

• docs/ checklist with environment prerequisites (Keycloak or login.gov-style IdP, YubiKey/platform authenticator, HTTPS origin)
• Optional Playwright/Cypress scaffold (non-blocking CI) if cost is justified
• Record last successful run date on the issue when dogfooded

API changes

None.

Data model changes

None.