fix(Dockerfile): ensure forks exists on fs before make deps (#2567)

Release action is
[failing](https://github.com/supabase/auth/actions/runs/27016942895/job/79738663274)
due to the Dockerfile calling make deps before the source for the
replace directive is set.

Co-authored-by: Chris Stockton <chris.stockton@supabase.io>

feat(conf): add JSON config file support (#2540)

Adds two new replace directives to `go.mod` which point to the newly
created `internal/forks` directory:
* `github.com/joho/godotenv` => `./internal/forks/godotenv`
* `github.com/kelseyhightower/envconfig` => `./internal/forks/envconfig`

Each one is clone of the version we use from the public repos with no
additional changes made. This may be a repeatable pattern we could use
to work around some limitations of older packages and allow reaching
into internals to ease migrating away from them.

---------

Co-authored-by: Chris Stockton <chris.stockton@supabase.io>

fix(passkeys): enforce AAL checks on passkey registration and deletion (

#2565)

If a user has a verified MFA factor enrolled, then enforce AAL2 for
passkey registration and deletion.

Note: we explicitly do not gate the passkey update operation since it
can only be used to update the `friendly_name` of the passkey.

fix(passkeys): delete webauthn creds when user is soft-deleted (#2564)

Delete WebAuthn credentials when a user is soft deleted to prevent
authentication.

fix: Azure issuer validation (#2560)

Azure issuer validation fix

feat: add -failfast to make test command (#2553)

When builds fail you don't get feedback until all tests finish running.
In addtion it is also difficult to find which line failed, even if you
know what to search for.

Adding -testfail in the Makefile test target addresses causes tests to
stop on the first failure.

Co-authored-by: Chris Stockton <chris.stockton@supabase.io>

chore(ci): pin Oriole image (#2556)

Pin Oriole DB image to latest working version as `latest` has caused
some instability in CI.

fix(config): warn on invalid WebAuthn config instead of erroring (#2545)

Warns on invalid WebAuthn configuration as opposed to returning an error
which would prevent the startup of the Auth server. Also simplifies the
config validation to simply existence of required values.

chore(deps): bump dependencies (#2546)

Bumps dependencies flagged by govulncheck:
https://github.com/supabase/auth/actions/runs/26503275641/job/78049005474?pr=2544

fix: when version is empty set to 0.0.0 (#2531)

When no version is set the version metrics will exit, it's better to set
the version to 0.0.0 for local dev and to serve as a signal no version
was set.

Co-authored-by: Chris Stockton <chris.stockton@supabase.io>