BSM Magic Login v1.0.35 — Passkey enrollment handoff

- No registered passkey is now an expected enrollment state, not a red HTTP 400 error.
- Selecting passkey sign-in without an enrolled credential switches to identity verification and preserves the enrollment destination for password and email-link/code submission.
- After successful verification, the authenticated enrollment page presents the browser passkey registration action and redirects to the original destination after success.
- Fixed missing script registration on the custom enrollment page.
- Browser cancellation leaves the user authenticated and allows retry or skip.
- Existing passkeys and native WordPress password fallback remain available.

Verification: PHP lint, JavaScript syntax and ZIP integrity only. Live WordPress authentication, email handoff and WebAuthn registration/sign-in must be tested on site.
