feat(cli): authforgectl recovery list and revoke

* RecoveryCmd::List no longer takes a user — lists all active codes
  across users, matching the daemon's ListRecoveryCodes signature.
* RecoveryCmd::Revoke <user> calls RevokeRecoveryCode; exits 1 with
  a stderr message when the user has no active code.
* bus.rs gains list_recovery_codes() / revoke_recovery_code(user).
* Two new clap-parser tests cover the new subcommand shapes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cli/src/main.rs

@@ -95,7 +95,8 @@ enum PendingCmd {
 #[derive(Subcommand)]
 enum RecoveryCmd {
     Generate { user: String },
-    List { user: String },
+    List,
+    Revoke { user: String },
 }
 
 #[tokio::main]
@@ -174,4 +175,26 @@ mod tests {
         let c = Cli::try_parse_from(["authforgectl", "--json", "status"]).unwrap();
         assert!(c.json);
     }
+
+    #[test]
+    fn parse_recovery_list_takes_no_args() {
+        let c = Cli::try_parse_from(["authforgectl", "recovery", "list"]).unwrap();
+        assert!(matches!(
+            c.cmd,
+            Cmd::Recovery {
+                cmd: RecoveryCmd::List
+            }
+        ));
+    }
+
+    #[test]
+    fn parse_recovery_revoke_with_user() {
+        let c = Cli::try_parse_from(["authforgectl", "recovery", "revoke", "alice"]).unwrap();
+        match c.cmd {
+            Cmd::Recovery {
+                cmd: RecoveryCmd::Revoke { user },
+            } => assert_eq!(user, "alice"),
+            _ => panic!("wrong subcommand"),
+        }
+    }
 }