feat(daemon): wire RecoveryStore into AppState with AUTHFORGE_RECOVERY_DIR override

StorageConfig gains a recovery_dir field; from_env_or_defaults reads
AUTHFORGE_RECOVERY_DIR (default /var/lib/authforge/recovery). AppState
exposes issue/list/revoke methods that Task 6 wires through D-Bus. Test
fixtures in state.rs and dbus.rs updated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

daemon/src/dbus.rs

@@ -220,6 +220,7 @@ central_path = "{}"
                 crate::state::StorageConfig {
                     policy_dir,
                     pending_dir: tmp.path().join("pending"),
+                    recovery_dir: tmp.path().join("recovery"),
                     userdb_path: tmp.path().join("users.db"),
                     pam_profile_path: tmp.path().join("authforge-pamconf"),
                     pam_auth_update: shim,