docs(gui): smoke-test recipes for Policy and Recovery tabs

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

gui/TESTING.md

@@ -45,3 +45,22 @@ Walk-through:
 6. Kill the daemon (`pkill authforged`), click Enroll → toast appears
    with the disconnected message; Retry on the page reconnects after
    restart.
+
+## Policy tab smoke
+
+1. Daemon running (same setup as Keys tab smoke).
+2. Open the GUI → Policy tab. Three rows: gdm-password, sudo, sshd. All start at "Disabled" on a clean system.
+3. Set sudo to "Required" → Apply. With no enrolled keys you'll see an inline banner "Would lock users out — sudo: <user>: no fido2 enrolled" and a "Force apply" button.
+4. Click "Force apply" → toast "Policy applied".
+5. Switch to Keys tab → enroll a Yubikey → switch back. Apply again with sudo=Required → toast "Policy applied" without the banner.
+6. In another terminal: `authforgectl policy show` should reflect the change.
+7. Run `authforgectl policy set sshd disabled --methods fido2` externally → Policy tab refreshes within ~1s (PolicyChanged signal).
+8. Expand "Advanced" — any non-master stack the daemon discovered shows here with the same Disabled/Optional/Required combo.
+
+## Recovery tab smoke
+
+1. Open Recovery tab. Empty list with hint text.
+2. Type "alice" in the username row, click "Generate code". Modal opens showing the 8-digit code with a Copy button. Click Copy → paste somewhere to verify clipboard worked.
+3. Close the modal. List now shows alice with "expires in 7 day(s)".
+4. Click "Revoke" on alice's row → row vanishes, toast confirms.
+5. Generate again, then run `authforgectl recovery list` externally — should show alice with the same expiry.