feat: add spatial workers, packed coordinates, passkeys and ZK sharding

[prissca]

Summary

• Move viewport spatial indexing and point clustering into a Web Worker using transferred coordinate buffers.
• Store request locations and creation timestamps in a fixed 16-byte Soroban value while preserving the existing getter shape and legacy reads.
• Add server-verified WebAuthn registration/login, one-time expiring challenges, shared Redis credential storage, and signed session tokens.
• Shard circuit JSON during dev/build, stream and verify chunks, and support cached byte ranges through Workbox.

Closes #503
Closes #505
Closes #506
Closes #507

Validation

• Node tests for clustering, passkey challenge replay/expiry, JWT validation, and byte-range responses.
• Python sharder test and JavaScript lint passed.
• Rust tests and the full Vite build could not be completed locally: this Windows host lacks link.exe, and the installed Rolldown native binding fails to load.

[drips-wave]

@prissca Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits