Login now includes a passkey sign-in path when the auth server supports WebAuthn, with opt-in enrolment after magic link sign-in.

Microsoft OAuth avatars now read the standard picture claim, so Azure users get their profile image like Google and GitHub users.