feat(iam): complete recovery security slice

[BeforeLights]

Summary

• add bounded, generic account recovery request and completion flows
• add Argon2-safe token validation, challenge CAS, recovery MFA re-enrollment gate, and privileged approval protection
• add replaceable in-memory/Redis recovery admission adapters with separate completion namespace
• extend composition, session context, OpenAPI, traceability, and focused tests
• align IAM mocks and test fixtures with the repository async lint contract

Verification

• corepack pnpm repo:check
• corepack pnpm requirements:check
• targeted IAM lint and tests

Review flow

This is the integration PR to dev; CodeRabbit review is intentionally reserved for the subsequent dev to main promotion PR.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4f38a86e-a1fb-4bda-b26a-c228cfce2d35

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}