Add passkey and magic link authentication

README.md

@@ -62,6 +62,20 @@ Never commit or lose `.env.keys`. Production should receive
 `DOTENV_PRIVATE_KEY_PRODUCTION` through its secret manager rather than copying
 the keys file onto the server.
 
+## Passwordless authentication
+
+Passkeys are the preferred sign-in method. `APP_ORIGIN` must exactly match the
+public origin used for registration and authentication, while `PASSKEY_RP_ID`
+must be that hostname or a registrable parent domain. The hosted environments
+use `shd.build`, allowing credentials on both `shd.build` and
+`dev.shd.build`. Direct localhost development should use `localhost`.
+
+Magic links require `SMTP_HOST`, `SMTP_PORT`, `SMTP_SECURE`, `SMTP_USER`,
+`SMTP_PASSWORD`, and `SMTP_FROM`. Port 465 normally uses
+`SMTP_SECURE=true`; port 587 normally uses `false` and upgrades with STARTTLS.
+Email identities become usable only after the account owner follows a
+15-minute, single-use verification link.
+
 ## Validate
 
 ```sh