feat: v0.20 routes and recovery sessions in every adapter #232

What the v0.20 API (epic fells-code/seamless-auth-api#386) needs from the adapters. Contract: @seamless-auth/types 0.30.0 (fells-code/seamless-auth-types#108).

Recovery sessions (fells-code/seamless-auth-api#491)

• An access token may carry recovery: true. requireAuth (and the Next.js / Go / Python / Rust equivalents) refuses it by default with 403 enrollment_required, with an option to allow it, so an app does not treat a half-recovered account as signed in.
• After passkey registration or TOTP enrollment from a recovery session, the API lifts the restriction on the session; the adapter should refresh so the cookie's access token drops the claim.

Routes

Manifest-driven (public / pre-auth; picked up from /.well-known/seamless-adapter.json, verify they work):

• POST /recovery-codes/redeem (preAuth -> session)
• POST /recovery/start, /recovery/verify, GET /recovery/status, POST /recovery/complete (preAuth; complete -> session), POST /recovery/cancel (public) (feat: self-service account recovery with a delay and notices seamless-auth-api#493)

Access routes needing explicit passthroughs (no catch-all proxy; see the seven-file checklist):

• GET /recovery-codes, POST /recovery-codes
• GET /system-config/policy, PUT /system-config/policy/draft, DELETE /system-config/policy/draft, POST /system-config/policy/publish, POST /system-config/policy/rollback, GET /system-config/policy/versions, POST /system-config/policy/dry-run (feat: stage, publish, roll back and dry-run auth policy changes seamless-auth-api#492)

Pass through unchanged

• 403 step_up_required with its status fields on every admin write (feat(admin): require a fresh step-up on admin writes seamless-auth-api#490), 409 secret_required with variable (#489), 409 policy_version_conflict (#492).

Related: #231 (placeholder secrets), #225-#230 (hardening). Ship in the one v0.20 adapter release, before API 0.20.0.