P2: Let people remove and rename their passkeys from Account

Why

Passkey Central’s account-settings pattern expects people to create, view, rename, and remove their own passkeys. Vole’s Account page lists and adds passkeys, but it has no remove or rename control: only an instance admin can remove one with vole admin account rm-credential. A lost or shared device therefore needs an admin, and a label typo is permanent.

Scope

• Add a remove form for each passkey on the Account page: CSRF, a confirmation, identity.RemoveCredential, and the sessions tied to that credential. The foreign key already cascades; make the intent explicit and audited.
• Add a rename/relabel control. A label is display text, not identity, so this is a small update beside the credential, bounded by MaxCredentialLabel.
• Decide what happens when the last passkey is removed and the account has no SSH key: refuse with an explanation, or allow and point at the admin invite. Do not lock someone out silently.
• Audit identity.credential-remove and the rename; update docs/accounts-and-access.md, which currently says a person can register another passkey but not that they can remove one.
• Tests for removing the last credential, removing one of several, a rename, and a CSRF refusal.

Acceptance

• A signed-in person can remove and rename their own passkeys from Account.
• Removing a passkey ends the sessions it created and is recorded in the audit log.
• The last-credential case has a clear, tested rule.
• The account documentation matches the controls.

Related: #213 (sign-in autofill), #106 (internal review).