Testing: Multiple passkeys (#125) and initCodeHash in CREATE2 salt (#126)

## Overview

This issue tracks comprehensive testing for two recently merged features:
- #125 - Support multiple passkeys per account for enhanced security and device redundancy
- #126 - Include implementation address in CREATE2 salt for convenient testing

## Testing Scope

### 1. Smart Contract Tests (#125 - Multiple Passkeys)

#### Unit Tests
- [ ] Test adding multiple passkeys (2-5 passkeys)
- [ ] Test maximum passkey limit enforcement
- [ ] Test signature validation with any registered passkey
- [ ] Test adding passkey requires existing passkey signature
- [ ] Test removing passkey requires existing passkey signature
- [ ] Test cannot remove the last passkey
- [ ] Test `getAllPasskeys()` returns correct list
- [ ] Test `isPasskeyRegistered()` for registered and unregistered keys
- [ ] Test gas costs for validation with multiple passkeys
- [ ] Test passkey operations with 2FA enabled/disabled

#### Integration Tests
- [ ] Test UserOperation validation with different passkeys
- [ ] Test adding passkey via UserOperation
- [ ] Test removing passkey via UserOperation
- [ ] Test transaction signing with multiple devices (simulate)
- [ ] Test passkey management alongside guardian recovery

#### Edge Cases
- [ ] Test adding duplicate passkey (should revert)
- [ ] Test removing non-existent passkey (should revert)
- [ ] Test signature validation with removed passkey (should fail)
- [ ] Test array bounds and gas limits with maximum passkeys

### 2. Smart Contract Tests (#126 - CREATE2 Salt)

#### Unit Tests
- [ ] Test `_computeSalt()` includes implementation address
- [ ] Test same user salt with different implementations produces different addresses
- [ ] Test same user salt with same implementation produces same address
- [ ] Test address collision prevention
- [ ] Test `getAddress()` matches actual deployed address
- [ ] Test factory deployment with new salt formula

#### Integration Tests
- [ ] Test account creation with new salt calculation
- [ ] Test reusing same index after contract upgrade
- [ ] Test multiple accounts with same owner but different salts
- [ ] Test initCode generation matches salt calculation

#### Regression Tests
- [ ] Verify existing deployed accounts still work
- [ ] Test that old addresses are not affected

### 3. Frontend Tests (#125 - Multiple Passkeys)

#### UI Tests
- [ ] Test "Add Passkey" flow in settings
- [ ] Test passkey list display (device name, date added)
- [ ] Test "Remove Passkey" button and confirmation
- [ ] Test cannot remove last passkey (UI disabled)
- [ ] Test passkey selection during transaction signing
- [ ] Test error handling for failed passkey operations

#### Integration Tests
- [ ] Test adding passkey from different browser/device
- [ ] Test transaction signing with newly added passkey
- [ ] Test removing passkey and verify it can't sign
- [ ] Test passkey management with Web3Auth owner

### 4. Frontend Tests (#126 - CREATE2 Salt)

#### SDK Tests
- [ ] Test `accountManager.getAccountAddress()` with new salt
- [ ] Test `accountManager.getInitCode()` matches contract
- [ ] Test account creation with new factory deployment
- [ ] Test address calculation matches on-chain address

#### Integration Tests
- [ ] Test creating account with new factory
- [ ] Test sending first transaction (with initCode)
- [ ] Test sending second transaction (without initCode)
- [ ] Test account address remains consistent

### 5. End-to-End Tests

#### Multiple Passkeys E2E
- [ ] Create account with initial passkey
- [ ] Add second passkey from settings
- [ ] Sign transaction with first passkey
- [ ] Sign transaction with second passkey
- [ ] Remove first passkey
- [ ] Verify can still sign with second passkey
- [ ] Verify cannot sign with removed passkey

#### CREATE2 Salt E2E
- [ ] Deploy account with new factory
- [ ] Verify address matches SDK calculation
- [ ] Send transaction to deploy account
- [ ] Verify account deployed to correct address
- [ ] Send second transaction (account already deployed)
- [ ] Test with different salt values

### 6. Security Tests

#### Multiple Passkeys Security
- [ ] Test unauthorized passkey addition (should fail)
- [ ] Test unauthorized passkey removal (should fail)
- [ ] Test signature replay with removed passkey
- [ ] Test passkey validation doesn't leak information
- [ ] Test gas griefing with maximum passkeys

#### CREATE2 Salt Security
- [ ] Test address collision resistance
- [ ] Test salt calculation determinism
- [ ] Test implementation address cannot be spoofed

### 7. Performance Tests

- [ ] Benchmark gas costs for validation with 1, 3, 5 passkeys
- [ ] Benchmark `getAllPasskeys()` with maximum passkeys
- [ ] Test RPC call efficiency for passkey operations
- [ ] Test frontend performance with multiple passkeys

### 8. Documentation Tests

- [ ] Verify COUNTERFACTUAL_ADDRESS.md reflects new salt formula
- [ ] Verify code comments are accurate
- [ ] Verify deployment documentation is up to date
- [ ] Create user guide for multiple passkeys feature

## Test Environments

- [ ] Local Anvil/Hardhat
- [ ] Sepolia Testnet
- [ ] Different browsers (Chrome, Firefox, Safari)
- [ ] Different devices (Desktop, Mobile)
- [ ] Different passkey types (Platform authenticator, Security key)

## Success Criteria

- All unit tests pass with >95% code coverage
- All integration tests pass
- All E2E tests pass on testnet
- No security vulnerabilities identified
- Gas costs are acceptable (<500k gas for worst case)
- Frontend works smoothly across browsers
- Documentation is complete and accurate

## Related Issues

- Closes #125 (after testing complete)
- Closes #126 (after testing complete)
- Related to Phase 2 FIDO MDS integration

## Priority

High - These are core features that need thorough testing before production use.