Option 1 — Security Key app (FIDO2/U2F)

Official Ledger app; registers the Nano X as a WebAuthn authenticator.

• Enroll in Authentik: the entire SSO surface becomes hardware-gated at login.
• Enroll in Forgejo as 2FA.
• Limits: no resident keys yet (second factor, not a passwordless passkey); USB-only in practice.

Lowest-effort, highest-coverage first move given Authentik fronts most house surfaces.