feat: connect to dApps with Liquid Auth (passkey-linked WebRTC, ARC-27 + ARC-60)

- k8s/deployment-liquid-auth-stage.yaml: stage instance, passkey origin
  stage.wallet.biatec.io, CORS for all stage Biatec Wallet hosts
- k8s/deployment-liquid-auth-stable.yaml: production instance (renamed)
- .github/workflows/liquid-auth.yml: deploy-stage (Stage env, automatic on
  manifest/workflow changes) then deploy-production (Production env,
  required-reviewer approval); syncs the k8s Secret from LIQUID_AUTH_*
  environment secrets, clears stray probe handlers, rolls out, smoke tests
- k8s/README.md: pipeline, secrets to configure, domain/passkey caveats;
  scripts take stage|stable

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

API (ghcr.io/algorandfoundation/liquid-auth), single-node MongoDB with PVC,
non-persistent Redis, and two nginx ingresses: REST with CORS-with-credentials
for the wallet origin and a Secure cookie flag, /socket.io for WebSocket
signaling from any dApp origin. Secrets/apply helper scripts and docs.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Adds a second dApp transport next to WalletConnect, following the Algorand
Foundation's Liquid Auth protocol: the wallet registers/uses a passkey at a
Liquid Auth service with the "liquid" extension (service challenge signed by
the account key, linked to the dApp's requestId), then negotiates a direct
WebRTC data channel (public Google STUN) and answers ARC-0027 messages:
arc0027:sign_transactions (ARC-0001) and the arc0060:sign_data extension.

- src/scripts/liquid/protocol.ts: ARC-0027 CBOR+base64url envelope, deep links
  (mirror of the codec in biatec-wallet-use-wallet-client)
- src/scripts/liquid/webauthn.ts: attestation/assertion ceremonies
- src/shared/liquid.ts: signaling socket + RTCPeerConnection per pairing,
  presence-driven renegotiation
- src/store/liquid.ts: sessions, requests, responses, ARC-60 domain checks
- src/shared/decodeSignRequests.ts: request decoders extracted from wc.ts and
  shared by both transports (accept base64 and base64url)
- signer/signLiquidChallenge (sk + HD accounts), liquid/reset on logout
- Connect page: "Liquid Auth" tab; request tables take a `namespace` prop
- docs/LIQUID_AUTH.md: protocol summary, trust model, service deployment
  (RP ID must be the wallet's domain, CORS with credentials)
- locales: connect.liquid.* in all languages (English text for now)
- playwright/unit/liquidProtocol.spec.ts

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Bumps [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) from 2.10.43 to 2.11.0.
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](https://github.com/web-platform-dx/baseline-browser-mapping/compare/v2.10.43...v2.11.0)

---
updated-dependencies:
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>