Replace the random-number stub at dbus.rs:132 with state.issue_recovery, add ListRecoveryCodes (returns Vec<RecoveryCodeSummary>) and RevokeRecoveryCode. New polkit actions list-recovery / revoke-recovery (auth_admin_keep). Adds 4 D-Bus integration tests; the previously-stub generate-code test now exercises the real Argon2id-backed write path. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>