feat: break-glass admin that no policy can disable #401

Why

A bad policy change (for example, phishing-resistant only with no enrolled keys) can lock out every admin. There must be a way back that policy cannot remove.

What

• A designated break-glass account or credential, configured at deploy time
• Exempt from login policy, still requires a strong factor
• Every use raises a high-severity audit event and notification

Done when

Admins can always recover the deployment, and every use is loud.