[FEATURE] YubiKey and WebAuthn login for Termix Mobile

Platform

Mobile app (iOS and Android)

Is it related to an issue?

Follow-up to #620. Mobile 1.4.0 already provides local App Lock with PIN and biometric unlock, but the native Termix account login flow does not provide a first-class WebAuthn/security-key path for server accounts.

OIDC users can use a provider-backed passkey or security key through the system browser. This request is specifically for Termix-native server accounts.

The Solution

Add WebAuthn/security-key authentication support to the Termix Mobile login flow so a registered YubiKey can be used to authenticate a Termix server account.

The implementation should:

• expose a security-key/passkey login action when the connected Termix server supports WebAuthn
• perform the ceremony through the platform-supported browser/authentication session on iOS and Android
• return the verified result to the app without exposing credentials to the embedded WebView
• support existing server-side WebAuthn registrations rather than creating a separate mobile-only credential store
• preserve the existing password, TOTP, and OIDC login paths
• distinguish unsupported server versions, user cancellation, timeout, and failed assertions
• include validation on both iOS and Android with a physical YubiKey where platform transport support permits it

Non-goals

• replacing the existing local App Lock PIN or biometric gate
• requiring a YubiKey every time the app returns from the background
• implementing provider-side OIDC WebAuthn, which already runs through the system browser

Acceptance criteria

1. A user with an existing WebAuthn security key registered on the Termix server can select security-key login in Mobile.
2. The platform authentication flow completes and returns an authenticated Termix session.
3. Password/TOTP/OIDC login behavior remains unchanged.
4. Cancellation and unsupported-device/server cases produce actionable errors.
5. Automated coverage protects capability detection and callback/session handling; physical-key validation is documented for iOS and Android.

Start with the Termix Mobile login flow and determine how capability detection, platform authentication sessions, and callback/session handling are currently structured on iOS and Android. Define coverage for supported and unsupported servers, cancellation, timeouts, failed assertions, and unchanged password/TOTP/OIDC paths; document physical YubiKey validation for both platforms.