feat(settings): wire passkey management UI to backend

[MagentaManifold]

Because

• we want passkey management UI to actually work

This pull request

• wires passkey management UI to backend

Issue that this pull request solves

Closes: FXA-13073

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on:
• Suggested review order:
• Risky or complex parts:

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

I checked with UX, and passkey delete indeed should be a modal, while registration is a separate page.

[Copilot]

Pull request overview

Wires the Settings “Passkeys” management UI into the FxA backend by adding passkeys to the settings account state/storage model, fetching passkeys from auth-server, and invoking backend APIs for passkey operations. It also fixes auth-server passkey handlers to treat uid as hex when constructing buffers.

Changes:

• Add passkeys to settings account state, unified localStorage schema, and account data fetching/refresh flows.
• Update Settings UI components (UnitRowPasskey/PasskeySubRow) to read passkeys from account context and call backend passkey APIs.
• Fix auth-server passkey/account handlers to use Buffer.from(uid, 'hex') when querying passkeys.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
packages/fxa-settings/src/models/contexts/AppContext.ts	Adds passkeys to the default mock account context.
packages/fxa-settings/src/models/contexts/AccountStateContext.tsx	Extends account state model to include passkeys and serializes it through unified storage.
packages/fxa-settings/src/models/Account.ts	Adds passkeys getter, refresh support, and passkey delete/rename methods.
packages/fxa-settings/src/lib/hooks/useAccountData.ts	Adds passkeys support to consolidated account fetch/field refetch logic.
packages/fxa-settings/src/lib/account-storage.ts	Extends unified localStorage schema to persist passkeys.
packages/fxa-settings/src/components/Settings/UnitRowPasskey/index.tsx	Switches to reading passkeys from useAccount() and keys subrows by credentialId.
packages/fxa-settings/src/components/Settings/UnitRowPasskey/index.test.tsx	Updates tests to provide passkeys through AppContext.
packages/fxa-settings/src/components/Settings/UnitRowPasskey/index.stories.tsx	Updates stories to provide passkeys (and mock passkey methods) via AppContext.
packages/fxa-settings/src/components/Settings/SubRow/index.tsx	Updates passkey row data shape and calls account.deletePasskey from UI.
packages/fxa-settings/src/components/Settings/SubRow/index.test.tsx	Updates passkey subrow tests to mock useAccount() instead of passing deletePasskey as a prop.
packages/fxa-settings/src/components/Settings/SubRow/index.stories.tsx	Updates passkey stories to new passkey data shape.
packages/fxa-settings/src/components/Settings/Security/index.tsx	Adds UnitRowPasskey into Security settings behind a feature flag.
packages/fxa-content-server/server/config/local.json-dist	Adds passkey-related feature flags to local config template.
packages/fxa-auth-server/lib/routes/passkeys.ts	Uses hex-decoding for uid buffer conversion in passkey routes.
packages/fxa-auth-server/lib/routes/account.ts	Uses hex-decoding for uid when listing passkeys in the consolidated /account response.
libs/accounts/passkey/src/lib/passkey.repository.in.spec.ts	Updates test description to reflect lastUsedAt naming.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dschom]

Valerie made a comment on my PR that we wanted to move away from using Account.ts and use auth-client directly. Personally I don't see this a blocker, but @vpomerleau what are your thoughts?

[vpomerleau]

In this case since it ties in with the data fetching/refresh, this probably makes sense? But I'll admit I haven't looked closely at this model since we switched from graphql to REST

[dschom]

👍

[vpomerleau]

Tested locally and all happy paths appear to be working as expected 🚀

I would just recommend a change to the error handling before merging.