mavweb: the last two pages leave Go (V-409)

CLAUDE.md says every page is its own embedded .html file next to main.go,
and that no page markup lives in Go. Two pages were still Go string
constants: passkeyPageHTML in webauthn.go and modelsHTML in models.go. They
are now passkey.html and models.html, embedded.

The identifiers keep their names, so passkey_prf_test.go still reads
passkeyPageHTML and still asserts on the same bytes.

Both templates now build through parsePage, and Page and handleModels render
through renderPage. handleEcosystem did too and now does the same.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

cmd/mavweb/ecosystem.go

@@ -117,8 +117,5 @@ func handleEcosystem(w http.ResponseWriter, r *http.Request, urls ecoURLs, core
 		d.Calls.Rows = rows
 	}
 
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	if err := ecosystemTmpl.Execute(w, d); err != nil {
-		log.Printf("ecosystem render: %v", err)
-	}
+	renderPage(w, ecosystemTmpl, d)
 }