fix(auth): ensure token storage before user state updates

- Store authentication tokens explicitly before setting user state in login
  and TOTP verification flows to prevent race conditions
- Add 'credentials: include' to WebAuthn endpoints for proper session
  cookie handling
- Add comprehensive debug logging throughout authentication flow to trace
  token lifecycle and API requests
- Update WebAuthn completeLogin to use fetch directly instead of request
  helper to properly handle session cookies
- Add allowedHosts configuration to Vite dev server

src/pages/auth/LoginPage.tsx

@@ -129,7 +129,7 @@ export default function LoginPage() {
 
     try {
       // Step 1: Get login options from server
-      const options = await api.webauthn.beginLogin(emailToUse) as unknown as WebAuthnLoginOptions;
+      const options = await api.webauthn.beginLogin(emailToUse) as WebAuthnLoginOptions;
 
       // Step 2: Create assertion using browser WebAuthn API
       const assertion = await createLoginAssertion(options);