fleet-manager: allow multiple WebAuthn origins (comma-separated RP_ORIGIN)

Passkeys bind to the exact scheme://host:port the browser used, so a single
configured origin fails "Error validating origin" when reached via a different
form (e.g. :9500 direct vs a 443 proxy). Split FLEET_MGR_RP_ORIGIN on commas so
several exact origins can be allowed. Single-value config is unchanged.

serving/fleet-manager/webauthn.go

@@ -15,6 +15,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 	"sync"
 	"time"
 
@@ -191,9 +192,18 @@ func newWebAuthn(cfg config) (*webauthn.WebAuthn, error) {
 	if cfg.rpID == "" || cfg.rpOrigin == "" {
 		return nil, fmt.Errorf("WebAuthn needs FLEET_MGR_RP_ID and FLEET_MGR_RP_ORIGIN (the admin UI hostname/origin)")
 	}
+	// FLEET_MGR_RP_ORIGIN may list several exact origins (comma-separated) — e.g.
+	// the direct :9500 form and a 443-proxy form — since passkeys bind to the
+	// exact scheme://host:port the browser used. Each must match a real origin.
+	var origins []string
+	for _, o := range strings.Split(cfg.rpOrigin, ",") {
+		if o = strings.TrimSpace(o); o != "" {
+			origins = append(origins, o)
+		}
+	}
 	return webauthn.New(&webauthn.Config{
 		RPID:          cfg.rpID,
 		RPDisplayName: cfg.rpDisplayName,
-		RPOrigins:     []string{cfg.rpOrigin},
+		RPOrigins:     origins,
 	})
 }