fix(webauthn): validate the key label before the browser ceremony

options() now validates the label before returning creation options, so clicking
Add with a blank/invalid name aborts before navigator.credentials.create() and
never leaves an orphaned credential on the authenticator.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/Livewire/Settings/WebauthnKeys.php

@@ -18,6 +18,9 @@ class WebauthnKeys extends Component
     public function options(WebauthnService $webauthn): array
     {
         abort_unless($webauthn->available(), 404);
+        // Validate the label BEFORE the browser ceremony, so an invalid name never
+        // leaves an orphaned credential on the authenticator.
+        $this->validate();
 
         return $webauthn->registrationOptions(Auth::user());
     }

tests/Feature/WebauthnKeysTest.php

@@ -32,6 +32,18 @@ class WebauthnKeysTest extends TestCase
         $this->assertDatabaseHas('webauthn_credentials', ['user_id' => $user->id, 'name' => 'YubiKey 5C']);
     }
 
+    public function test_options_validate_label_before_ceremony(): void
+    {
+        $user = User::factory()->create();
+        $this->actingAs($user);
+        $this->mock(WebauthnService::class)->shouldReceive('available')->andReturn(true);
+
+        Livewire::test(WebauthnKeys::class)
+            ->set('newName', '')
+            ->call('options')
+            ->assertHasErrors('newName');
+    }
+
     public function test_remove_deletes_credential(): void
     {
         $user = User::factory()->create();