#496 The passkey test says what the page showed when its button never appears

[Anonymous]

Originally created by: athanclark

Refs [#465]. This adds diagnostics and isn't a fix, so the issue stays open.

test/passkeys-live-postgres.mjs once timed out waiting for Sign in with a passkey on /login, and passed when re-run. I followed the code paths, and none of them explains it:

• Signing out: the test's signOut waits until /api/session reports no user, then leaves the account page for about:blank.
• The two-factor step: answering it with a passkey deletes its challenge in the same transaction that issues the session. So /login can't resume a stale challenge step that hides the button.
• Rate limits: /api/session has none, so the page's own session read isn't refused.
• Display condition: the button shows whenever the session says the site offers passkey sign-in, mode is login, and the browser supports passkeys.

What this PR changes: if the button never appears, the test prints three things before failing:

• the page's address;
• the sign-in card's text, which shows a loading line, an error or the step it's on;
• /api/session as the browser sees it.

The next failure will then show which of those went wrong.

🤖 Generated with Claude Code

https://claude.ai/code/session_011fFY8eruEi1xAkkMBni13B

[Anonymous]

Ticket changed by: athanclark

• status: open --> closed