Phishing-resistant login with hardware security keys (Ledger, YubiKey, any FIDO2 key) for any user role, with optional password-free login.