feat(daemon): recovery code generation and Argon2id hashing

Pure-logic module: generate 8-digit codes, Argon2id PHC hash with OS RNG salt,
verify via constant-time PasswordVerifier. Dead-code allow until Task 4 wires
the store on top.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

daemon/src/main.rs

@@ -7,6 +7,7 @@ mod fido;
 mod lockout;
 mod policy_apply;
 mod polkit;
+mod recovery;
 mod state;
 mod storage;