feat(daemon): real GenerateRecoveryCode + ListRecoveryCodes + RevokeRecoveryCode

Replace the random-number stub at dbus.rs:132 with state.issue_recovery,
add ListRecoveryCodes (returns Vec<RecoveryCodeSummary>) and RevokeRecoveryCode.
New polkit actions list-recovery / revoke-recovery (auth_admin_keep). Adds
4 D-Bus integration tests; the previously-stub generate-code test now
exercises the real Argon2id-backed write path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

common/src/types.rs

@@ -59,6 +59,12 @@ pub struct PolicyApplyResult {
     pub violations: Vec<Violation>,
 }
 
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, zvariant::Type)]
+pub struct RecoveryCodeSummary {
+    pub user: String,
+    pub expires_unix: u64,
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;