mavweb: add in-process auth gate for POST /tools

Add a local PasskeySession that handleTools checks before processing
any POST action (enable/disable). If the session hasn't been asserted
within the 5-minute TTL, return 403 Forbidden.

Changes:
- webauthn/session.go: add IsStepUp() convenience method (nil-safe)
- webauthn.go: PasskeyHandle holds a *PasskeySession; AssertFinish
  calls session.Assert() after IPC step-up
- main.go: create stepUpSession, pass to handleTools and
  newPasskeyHandle; handleTools returns 403 if !session.IsStepUp()
- handlers_test.go: update TestEnableTool_NoInProcessAuthGate to
  expect 403; add TestEnableTool_WithAuthGate_RequiresStepUp for
  the happy path with asserted session; update all 10 call sites

internal/webauthn/session.go

@@ -47,6 +47,16 @@ func (s *PasskeySession) CurrentLayer(_ context.Context, _ auth.Scope) auth.Laye
 	return auth.Layer2
 }
 
+// IsStepUp returns true if the session was recently asserted (within TTL).
+func (s *PasskeySession) IsStepUp() bool {
+	if s == nil {
+		return false
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return !s.assertedAt.IsZero() && time.Since(s.assertedAt) < s.assertionTTL
+}
+
 // Assert records a successful step-up gesture. The session bumps to L3 for
 // the assertion TTL. A nil receiver returns ErrStepUpUnsupported.
 func (s *PasskeySession) Assert(_ context.Context, _ auth.Scope) error {