feat(auth): trusted devices, recovery codes, and admin MFA management

Add opt-in "Trust this device" so a browser/app skips the TOTP step (never
the password) for 30 days, single-use bcrypt recovery codes as a 2FA-lockout
fallback, and admin trusted-device/MFA-reset management — backend, web UI,
OpenAPI spec, and tests.

- Schema: trusted_devices (sha256 token hash, looked up by unique index) and
  recovery_codes (bcrypt, single-use). Both additive/idempotent.
- Session service: trust-token mint/hash/resolve + cap helpers; new rg_trust
  httpOnly cookie (survives logout, revoked on untrust/password change/reset/
  TOTP disable). JWTs stay stateless — trust is a server-side row, not a claim.
- Web + mobile login accept a trusted-device token / recovery code; login/totp
  gains trustDevice + recoveryCode. Cap of 10/user with NO silent pruning — an
  over-cap trust returns 409/trustLimitReached and the client prompts to revoke.
- Self-service /auth/me/trusted-devices* + recovery-codes*; admin
  /admin/users/:id/trusted-devices* + /mfa/reset. All actions audit-logged.
- Client: "Trust this device" + recovery-code login options, one-time recovery
  code display, Trusted Devices + Recovery Codes account panels, a TOTP-styled
  revoke-to-continue cap modal, and admin per-user security controls.
- OpenAPI regenerated; 33 new server tests (all suites green).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/test/authMe.test.js

@@ -27,6 +27,13 @@ test('/auth/me/account* rejects unauthenticated callers with 401', async () => {
       ['POST', '/api/v1/auth/me/account/totp/setup'],
       ['POST', '/api/v1/auth/me/account/totp/enable', { code: '123456' }],
       ['DELETE', '/api/v1/auth/me/account/identities/google'],
+      // Trusted devices + recovery codes are self-service too — same gate.
+      ['GET', '/api/v1/auth/me/trusted-devices'],
+      ['POST', '/api/v1/auth/me/trusted-devices', { deviceName: 'X' }],
+      ['DELETE', '/api/v1/auth/me/trusted-devices'],
+      ['DELETE', '/api/v1/auth/me/trusted-devices/1'],
+      ['GET', '/api/v1/auth/me/account/recovery-codes/status'],
+      ['POST', '/api/v1/auth/me/account/recovery-codes/generate', { currentPassword: 'x' }],
     ]
     for (const [method, path, body] of calls) {
       const res = await fetch(app.url + path, {