fix: use ClapSerde::Opt for config deserialization to respect defaults

When deserializing the TOML config file directly into AppConfig, serde's
#[serde(default)] attribute was using Rust's Default trait for bool (false)
instead of the #[default(true)] attribute which only applies to the Default
trait implementation generated by ClapSerde.

Fix by deserializing into <AppConfig as ClapSerde>::Opt first, then
converting via AppConfig::from() which properly applies the defaults.

Also add default_value to always-uv CLI argument for consistency.

Update soft-fido2 to 0.12.2 which includes the duplicate notification fix.

Author: pando85

Cargo.lock

@@ -14,9 +14,9 @@ repository = "https://github.com/pando85/passless"
 passless-core = { path = "./passless-core", version = "0.9.2" }
 passless-config-doc = { path = "./passless-config-doc", version = "0.9.2" }
 
-soft-fido2 = "0.12.1"
-soft-fido2-ctap = "0.12.1"
-soft-fido2-transport = "0.12.1"
+soft-fido2 = "0.12.2"
+soft-fido2-ctap = "0.12.2"
+soft-fido2-transport = "0.12.2"
 
 thiserror = "2.0"
 clap = { version = "4.5", features = ["std", "color", "derive", "cargo", "env"] }

Cargo.toml

@@ -159,6 +159,7 @@ pub struct SecurityConfig {
         action = ArgAction::Set,
         require_equals = true,
         num_args = 0..=1,
+        default_value = "true",
         default_missing_value = "true"
     )]
     #[serde(default)]
@@ -420,10 +421,10 @@ impl AppConfig {
         {
             log::info!("Loading configuration from: {}", path.display());
             let content = std::io::read_to_string(BufReader::new(f)).unwrap_or_default();
-            match toml::from_str::<AppConfig>(&content) {
+            match toml::from_str::<<AppConfig as ClapSerde>::Opt>(&content) {
                 Ok(file_config) => {
-                    // Merge: file config + CLI args (CLI takes precedence)
-                    return file_config.merge(&mut args.config);
+                    // Deserialize into Opt, then convert with defaults and merge CLI args
+                    return AppConfig::from(file_config).merge(&mut args.config);
                 }
                 Err(e) => log::warn!("Failed to parse config file {}: {}", path.display(), e),
             }