feat(auth): trusted devices, recovery codes, and admin MFA management

Add opt-in "Trust this device" so a browser/app skips the TOTP step (never
the password) for 30 days, single-use bcrypt recovery codes as a 2FA-lockout
fallback, and admin trusted-device/MFA-reset management — backend, web UI,
OpenAPI spec, and tests.

- Schema: trusted_devices (sha256 token hash, looked up by unique index) and
  recovery_codes (bcrypt, single-use). Both additive/idempotent.
- Session service: trust-token mint/hash/resolve + cap helpers; new rg_trust
  httpOnly cookie (survives logout, revoked on untrust/password change/reset/
  TOTP disable). JWTs stay stateless — trust is a server-side row, not a claim.
- Web + mobile login accept a trusted-device token / recovery code; login/totp
  gains trustDevice + recoveryCode. Cap of 10/user with NO silent pruning — an
  over-cap trust returns 409/trustLimitReached and the client prompts to revoke.
- Self-service /auth/me/trusted-devices* + recovery-codes*; admin
  /admin/users/:id/trusted-devices* + /mfa/reset. All actions audit-logged.
- Client: "Trust this device" + recovery-code login options, one-time recovery
  code display, Trusted Devices + Recovery Codes account panels, a TOTP-styled
  revoke-to-continue cap modal, and admin per-user security controls.
- OpenAPI regenerated; 33 new server tests (all suites green).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/test/passwordResetController.test.js

@@ -18,6 +18,8 @@ const ctrl = require('../src/router/v1/auth/passwordReset.controller')
 const passwordResets = require('../src/model/passwordResets/passwordResets.model')
 const users = require('../src/model/users/users.model')
 const mobileSessions = require('../src/model/mobileSessions/mobileSessions.model')
+const trustedDevices = require('../src/model/trustedDevices/trustedDevices.model')
+const recoveryCodes = require('../src/model/recoveryCodes/recoveryCodes.model')
 const activity = require('../src/model/activity/activity.model')
 const mailer = require('../src/utils/mailer')
 const db = require('../src/utils/db')
@@ -46,7 +48,8 @@ beforeEach(() => {
   for (const [mod, name] of [
     [users, 'getActiveByEmail'], [users, 'getById'], [users, 'update'],
     [passwordResets, 'create'], [passwordResets, 'findValidByToken'], [passwordResets, 'consume'], [passwordResets, 'invalidatePendingForUser'],
-    [mobileSessions, 'revokeAllForUser'], [activity, 'log'], [mailer, 'sendPasswordReset'],
+    [mobileSessions, 'revokeAllForUser'], [trustedDevices, 'revokeAllForUser'], [recoveryCodes, 'clearForUser'],
+    [activity, 'log'], [mailer, 'sendPasswordReset'],
   ]) {
     orig[name] = { mod, val: mod[name] }
   }
@@ -55,6 +58,8 @@ beforeEach(() => {
   passwordResets.create = async () => ({ token: 'opaque-token' })
   passwordResets.invalidatePendingForUser = async () => {}
   mobileSessions.revokeAllForUser = async () => {}
+  trustedDevices.revokeAllForUser = async () => {}
+  recoveryCodes.clearForUser = async () => {}
 })
 afterEach(() => {
   for (const key of Object.keys(orig)) {