Complete Journal auth: add passkey prompt, dev magic link, fix validation

- Add passkey prompt after magic link login (/?add-passkey=1)
- addPasskeyStart/addPasskeyFinish for existing users
- Dev mode: magic link auto-redirects (returns devLink in response)
- Fix username validation: strip invalid chars instead of HTML pattern
- Separate API routes from page routes for JSON fetch compatibility

All 10 Group 7 tasks complete.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/journal/app/routes/api.auth.register.ts

@@ -1,6 +1,6 @@
 import { data } from "react-router";
 import type { Route } from "./+types/api.auth.register";
-import { startRegistration, finishRegistration, createSession } from "~/lib/auth.server";
+import { startRegistration, finishRegistration, createSession, addPasskeyStart, addPasskeyFinish } from "~/lib/auth.server";
 
 export async function action({ request }: Route.ActionArgs) {
   const body = await request.json();
@@ -18,6 +18,16 @@ export async function action({ request }: Route.ActionArgs) {
       return data({ step: "done" }, { headers: { "Set-Cookie": cookie } });
     }
 
+    if (step === "add-passkey") {
+      const options = await addPasskeyStart(userId);
+      return data({ step: "challenge", options });
+    }
+
+    if (step === "finish-add-passkey") {
+      await addPasskeyFinish(userId, response, challenge);
+      return data({ step: "done" });
+    }
+
     return data({ error: "Invalid step" }, { status: 400 });
   } catch (e) {
     return data({ error: (e as Error).message }, { status: 400 });