fix(auth): enable WebAuthn-only login and document setup

internal/ui/static/js/app.js

@@ -1155,7 +1155,7 @@ function initializeWebAuthn() {
     const loginButton = document.getElementById("webauthn-login");
     const usernameField = document.getElementById("form-username");
 
-    if (loginButton && usernameField) {
+    if (loginButton) {
         const abortController = new AbortController();
         loginButton.disabled = false;
 
@@ -1164,7 +1164,9 @@ function initializeWebAuthn() {
             webauthnHandler.login().catch(err => WebAuthnHandler.showErrorMessage(err));
         });
 
-        webauthnHandler.conditionalLogin(abortController).catch(err => WebAuthnHandler.showErrorMessage(err));
+        if (usernameField) {
+            webauthnHandler.conditionalLogin(abortController).catch(err => WebAuthnHandler.showErrorMessage(err));
+        }
     }
 }
 

miniflux.1

@@ -290,7 +290,11 @@ by the REST API HTTP Basic Authentication, and passwords can no
 longer be changed. API clients must use an API key instead.
 .br
 This option requires an alternative authentication source
-such as OAuth2 or auth proxy\&.
+such as OAuth2, auth proxy, or WebAuthn/Passkeys\&.
+.br
+To use WebAuthn as the only authentication method, register at
+least one Passkey while another authentication method is available,
+before enabling DISABLE_LOCAL_AUTH\&.
 .br
 If remote user creation is disabled, only existing users can sign in\&.
 .br