domain binding requires browser participation.

you can have a TOTP variant which has the browser display a challenge string & QR code, authenticator generates a 5-6 digit response. include more entropy in the response if you want to do away with the password entirely.

passkeys are trash, I would never opt for dedicated hardware (or a cloud service) and using them with a password manager is extremely messy when you want the password manager to be properly isolated from the rest of your system.