Owner passkey setup

Paste a one-time setup token from the first-owner bootstrap command or from a signed-in owner account, then register a passkey for this origin.