items 5-7: passkey step-up, tools enable/disable, note RAG — end to end

Completes the three in-flight open items and fixes the away-fallthrough bug.

Item 7 — passkey step-up (WebAuthn):
- internal/webauthn: ES256/P-256 register + assert with real ecdsa signature
  verification, minimal CBOR/COSE decode, PasskeySession (L2→L3 on assert,
  decays after TTL). Drop the RS256 offer we can't verify (register-ok/
  assert-fail trap). Verify rpIdHash + UP/UV flags in FinishAssertion — UV is
  the step-up gesture. Round-trip test with negative cases (tampered sig,
  missing UV, wrong origin).
- cmd/mavweb: /auth/passkey enroll+assert page (the only surface that can do
  a WebAuthn gesture) + the four begin/finish endpoints. Without this the
  daemon's PasskeySession swap leaves /tools enable permanently blocked.
- daemon wires PasskeySession as the auth Session + srv.StepUp; policy gates
  MethodAssertStepUp at AuthRead.

Item 5 — tools page: DisableTool through store/ipc/client/wire; /tools grows a
disable action and a link to the passkey page. Lifecycle test.

Item 6 — note RAG: PhraseQuery on the phraser (LLM-composed answer over top-k
notes, raw-notes fallback); IntentQuery routes through it. Stub returns a
deterministic summary.

Item 2 — away-fallthrough: on ErrVoiceNoSession the dispatcher now reroutes
through the AWAY table (sev3→ntfy, sev4→telegram-repeat-til-ack, sev≤2→drop)
instead of silently dropping / mis-routing to the present-list remainder.
Covers DispatchNudge + DispatchReminder. 4 tests.

Also: re-add ProposeTool to CoreAPI (dropped in a comment rewrite), fix
missing imports + a duplicate block left mid-edit, drop dead AssertStepUpFunc,
gitignore /mavcaldav.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/store/tools.go

@@ -78,6 +78,20 @@ func (s *Store) EnableTool(ctx context.Context, name string, cmd []string, destr
 	return nil
 }
 
+// DisableTool sets a tool's status from 'enabled' back to 'proposed'. This is
+// the "disable" act on the authed surface — the tool stays in the store (its
+// provenance preserved) but won't run until re-enabled. Idempotent: disabling
+// a tool that is already proposed or doesn't exist is a no-op.
+func (s *Store) DisableTool(ctx context.Context, name string) error {
+	_, err := s.db.ExecContext(ctx,
+		`UPDATE tools SET status = 'proposed', updated_ts = ? WHERE name = ? AND status = 'enabled'`,
+		time.Now().UnixMilli(), name)
+	if err != nil {
+		return fmt.Errorf("disable tool: %w", err)
+	}
+	return nil
+}
+
 // LookupTool returns the tool by name. ErrToolNotFound when absent.
 func (s *Store) LookupTool(ctx context.Context, name string) (Tool, error) {
 	row := s.db.QueryRowContext(ctx, `