feat(daemon): real GenerateRecoveryCode + ListRecoveryCodes + RevokeRecoveryCode

Replace the random-number stub at dbus.rs:132 with state.issue_recovery,
add ListRecoveryCodes (returns Vec<RecoveryCodeSummary>) and RevokeRecoveryCode.
New polkit actions list-recovery / revoke-recovery (auth_admin_keep). Adds
4 D-Bus integration tests; the previously-stub generate-code test now
exercises the real Argon2id-backed write path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

daemon/src/state.rs

@@ -233,7 +233,9 @@ impl AppState {
 
     #[allow(dead_code)] // wired through D-Bus in Task 6.
     pub async fn issue_recovery(&self, user: &str) -> Result<String, StateError> {
-        Ok(self.recovery.issue(user, crate::recovery::DEFAULT_TTL_SECS)?)
+        Ok(self
+            .recovery
+            .issue(user, crate::recovery::DEFAULT_TTL_SECS)?)
     }
 
     #[allow(dead_code)] // wired through D-Bus in Task 6.