fix(server): tidy passkey quirks after the DI fold

shared/src/auth/auth.schema.spec.ts

@@ -17,6 +17,7 @@ import {
   passkeyRegisterVerifyRequestSchema,
   passkeyLoginVerifyRequestSchema,
   passkeyRenameRequestSchema,
+  passkeyDeleteRequestSchema,
 } from './auth.schema';
 
 import { describe, it, expect } from 'vitest';
@@ -130,4 +131,10 @@ describe('passkey schemas', () => {
     expect(passkeyRenameRequestSchema.safeParse({}).success).toBe(true);
     expect(passkeyRenameRequestSchema.safeParse({ name: 42 }).success).toBe(true); // service-side sanitize owns the 400
   });
+
+  it('delete rejects a non-string password (used to 500 in bcrypt) but keeps omission a service rule', () => {
+    expect(passkeyDeleteRequestSchema.safeParse({ password: 'pw' }).success).toBe(true);
+    expect(passkeyDeleteRequestSchema.safeParse({}).success).toBe(true);
+    expect(passkeyDeleteRequestSchema.safeParse({ password: 123 }).success).toBe(false);
+  });
 });

shared/src/auth/auth.schema.ts

@@ -139,3 +139,11 @@ export const passkeyRenameRequestSchema = z.object({
   name: z.unknown().optional(),
 });
 export type PasskeyRenameRequest = z.infer<typeof passkeyRenameRequestSchema>;
+
+// DELETE /credentials/:id — outside the POST/PUT/PATCH boot gate, but typed
+// anyway: a non-string password used to reach bcrypt.compareSync and 500.
+// Optional keeps the missing-password 401 a service rule.
+export const passkeyDeleteRequestSchema = z.object({
+  password: z.string().optional(),
+});
+export type PasskeyDeleteRequest = z.infer<typeof passkeyDeleteRequestSchema>;