fix: reducer for PasskeyVerified sets VerifiedAt (#11929)

# Which Problems Are Solved

In https://github.com/zitadel/zitadel/pull/11858#discussion_r2993742914
we discussed on how to translate the ES passkey state to a relational
one. That is used to filter out passkeys during convertion to webauthn
credentials.

It was decided to consider passkeys in ready state those that have a
verified at `time.Time` set.

The change required fixing the reducer for the eventstore event.

# How the Problems Are Solved

  - Set `VerifiedAt` once `HumanWebAuthNVerifiedEvent` is received
  - Also set the verification to `nil`

# Additional Context

- Discussion #11858
- Follow-up for PR #11858

backend/v3/storage/database/dialect/postgres/migration/013_user_table/up.sql

@@ -185,7 +185,7 @@ CREATE TYPE zitadel.passkey_type AS ENUM (
 CREATE TABLE zitadel.user_passkeys(
     instance_id TEXT NOT NULL
     , token_id TEXT NOT NULL
-    , key_id BYTEA NOT NULL
+    , key_id BYTEA
 
     , user_id TEXT NOT NULL
 
@@ -194,12 +194,12 @@ CREATE TABLE zitadel.user_passkeys(
     , verified_at TIMESTAMPTZ
 
     , type zitadel.passkey_type NOT NULL
-    , name TEXT NOT NULL CHECK (name <> '')
+    , name TEXT NOT NULL DEFAULT ''
     , sign_count INT NOT NULL DEFAULT 0 CHECK (sign_count >= 0)
     , challenge BYTEA NOT NULL
-    , public_key BYTEA NOT NULL
-    , attestation_type TEXT NOT NULL CHECK (attestation_type <> '')
-    , authenticator_attestation_guid BYTEA NOT NULL
+    , public_key BYTEA
+    , attestation_type TEXT NOT NULL
+    , authenticator_attestation_guid BYTEA
     , relying_party_id TEXT NOT NULL CHECK (relying_party_id <> '')
 
     , PRIMARY KEY (instance_id, token_id)