feat(users): report a recovery session on /users/me #501

A client in cookie transport cannot read the access token, so the only signal that it holds a recovery session (recovery: true, from /recovery/complete or /recovery-codes/redeem) is the response that issued it. After a page reload the React SDK (fells-code/seamless-auth-react#211) can no longer route the user to enrollment, or refresh after enrolling to drop the claim.

• GET /users/me (already allowed for recovery sessions) returns session: { recovery: boolean } or a top-level recovery flag, read from the session row.
• Add it to MeResponseSchema in @seamless-auth/types (optional, so older clients still parse).
• The SDK reads it on hydration.