feat(recovery): deliver recovery notices through external delivery, and cancel from a signed-in session #499

Follow-up to #497 (fixed in #498 by failing closed). Today the opening notice for self-service recovery needs the API's direct transport, so a caller that owns delivery gets 503 recovery_notice_failed from /recovery/verify.

• @seamless-auth/types: a delivery kind for the opened notice, e.g. account_recovery_opened, carrying to, completesAt and the cancel URL, plus a distinct kind for the recovery code itself so an adapter can word it as a recovery warning.
• API: return the opened notice as delivery payloads from /recovery/verify for a credentialed external caller, count that as notified, and mark the route delivery: true in the adapter manifest.
• API: let any access session list and cancel the account's pending recovery requests without the token (docs/account-recovery.md calls this a follow-up).
• Adapters: deliver the new kinds (with seamless-auth-server#232) and the React SDK if it renders recovery.

Bundle the types change into the same minor as the break_glass_enrollment event name, so the adapter wave takes one types bump.