feat(daemon): real GenerateRecoveryCode + ListRecoveryCodes + RevokeRecoveryCode

Replace the random-number stub at dbus.rs:132 with state.issue_recovery,
add ListRecoveryCodes (returns Vec<RecoveryCodeSummary>) and RevokeRecoveryCode.
New polkit actions list-recovery / revoke-recovery (auth_admin_keep). Adds
4 D-Bus integration tests; the previously-stub generate-code test now
exercises the real Argon2id-backed write path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

daemon/src/storage/recovery.rs

@@ -161,7 +161,8 @@ impl RecoveryStore {
             return Ok(false);
         }
 
-        let ok = verify_code(candidate, phc).map_err(|e| RecoveryStoreError::Hash(e.to_string()))?;
+        let ok =
+            verify_code(candidate, phc).map_err(|e| RecoveryStoreError::Hash(e.to_string()))?;
         if ok {
             let _ = fs::remove_file(&path);
         }