Title: getPasskeyConfig() ignores configured rpId, always uses url.hostname — breaks passkeys behind reverse proxy

[sebhosting]

Description

Bug

When self-hosting EmDash behind a reverse proxy (Traefik, nginx, etc),
the internal request URL is localhost, causing getPasskeyConfig() to
set rpId: "localhost" regardless of the configured rpId.

Root Cause

In packages/auth/src/passkey/config.ts, getPasskeyConfig() derives
rpId from url.hostname instead of reading from config:

```ts
function getPasskeyConfig(url, siteName) {
return {
rpName: siteName || url.hostname,
rpId: url.hostname, // ← ignores config
origin: url.origin
};
}
```

Fix

Read rpId from config when available:

```ts
function getPasskeyConfig(url, siteName, config?) {
return {
rpName: config?.rpName || siteName || url.hostname,
rpId: config?.rpId || url.hostname,
origin: config?.origin || url.origin
};
}
```

Workaround

Patch the built chunk directly and set explicit values.

Environment

• Self-hosted Node.js + SQLite
• Behind Traefik reverse proxy
• Cloudflare DNS proxy

Steps to reproduce

Root Cause

In packages/auth/src/passkey/config.ts, getPasskeyConfig() derives
rpId from url.hostname instead of reading from config:

```ts
function getPasskeyConfig(url, siteName) {
return {
rpName: siteName || url.hostname,
rpId: url.hostname, // ← ignores config
origin: url.origin
};
}
```

Environment

Environment

• Self-hosted Node.js + SQLite
• Behind Traefik reverse proxy
• Cloudflare DNS proxy

Logs / error output

[seslly]

yeah ran into the same issue with my self hosted setup using nginx for ssl termination hopefully maintainers can take a look at my pr for the fixes

#225

[omgitsgela]

Adding another sanitized self-hosted data point here.

We hit the same class of passkey failure behind an nginx reverse proxy on a valid HTTPS deployment. The browser-side passkey creation flow failed until forwarded-origin handling was configured so the app used the external HTTPS origin consistently.

What changed locally:

• Added trusted domain/public-origin configuration for the external HTTPS hostname
• Added explicit proxy headers in nginx including X-Forwarded-Host, X-Forwarded-Port, and X-Forwarded-Proto
• Rebuilt and restarted the app

After that, passkey setup started working.

This seems consistent with the issue report that passkey config/origin handling is too tightly coupled to the internal request URL when EmDash is deployed behind a reverse proxy.