Add passkey and magic link authentication

docs/DESIGN_SYSTEM.md

@@ -69,6 +69,23 @@ Use the spacing tokens for new components. Prefer `8px`, `12px`, and `20px` gaps
   the left and the actionable secure-access console on the right.
 - OAuth providers appear as connection nodes with a recognizable provider color;
   SHD orange remains reserved for the primary local action and navigation.
+- Authentication prioritizes passkeys, followed by one-time email magic links.
+  Discord remains a prominent provider option, while username/password is an
+  explicitly labeled optional fallback in a collapsed control. Passkey controls
+  name the platform interaction rather than exposing WebAuthn terminology.
+- Verified email identities and registered passkeys appear as compact method
+  rows in Account Access. Every method displays its verification or device state,
+  registration date where useful, and protected removal behavior that prevents
+  an agent from deleting their last usable sign-in method.
+- Local username and password are one optional authentication method, separate
+  from the public display name and the immutable internal account identifier.
+  Agents may remove both local credentials together after adding another method,
+  and may restore them later with a new unique login username and password.
+- The “at least one sign-in method” rule is a server-side invariant shared by
+  self-service and ISAC actions. Passkeys, verified magic-link email, Discord,
+  and a complete local username/password pair each count as usable methods.
+  Controls may disable unsafe removal for clarity, but server validation remains
+  authoritative. Intentional soft account deletion is the sole exception.
 - Linked identity nodes show provider display name, account handle or stable ID,
   and an explicit textual `LINKED` state. Unlink controls sit beneath the node,
   require credential confirmation, and remain disabled with an explanation when