Fix passkey step-up for TOTP enrollment and streamline Compose

[bifrost0x]

Summary

• allow fresh passkey-authenticated sessions to authorize initial TOTP enrollment
• offer passkey reauthentication after the strong-assurance freshness window expires
• streamline and regroup the top-level Compose files without changing resolved defaults or hiding optional features

Testing

• pytest tests/ -q (1843 passed, 33 skipped)
• targeted authentication suite (77 passed)
• npm run lint:js
• npm run vendor:check
• npm run test:js (283 passed)
• Docker Compose validation for base, production, LDAP, and LDAP+production overlays
• resolved base defaults unchanged and all 47 operator options preserved