feat: refresh after enrollment from a recovery session #235

The Go, Python and Rust adapters refresh the session in cookie transport right after a successful POST /webauthn/register/finish or POST /totp/enroll/verify made from a recovery session (recovery: true on the access token). The new access cookie then drops the claim at once, and requireAuth stops answering enrollment_required. The JS adapters (#233) leave this to the client's next POST /auth/refresh.

• In core, after a 2xx on those two routes from a recovery session in cookie transport, refresh through the same path ensureCookies uses, and set the new access and refresh cookies on the response. Use the refresh token issued earlier in the same request if a silent refresh already happened.
• Wire it into the Express, Fastify and Next.js handling of both routes, with parity tests.
• If the refresh fails, return the enrollment answer unchanged.
• Bearer transport is unchanged: the client holds its refresh token and calls /auth/refresh itself.