[Bccorb]

Closes #215. Stacked on #218 (shared client pieces); merge that first.

Summary

Authenticator app (TOTP) screens for the Angular binding.

• Routes: paths.ts and routes.ts add two new screens:
  • register-authenticator (SaRegisterAuthenticator) is enrollment with a recovery-session subtitle. It ends on "Authenticator App Added" and continues where register-passkey does. On a device with passkeys it offers "Use a passkey instead".
  • authenticator-code (SaAuthenticatorCode) signs in with signInWithTotp, reusing sa-otp-input.
• SaAuthenticatorEnrollment: a new reusable piece with:
  • the QR code from qrCode() and the setup key with a copy button
  • an "Open in authenticator app" link
  • the first-code verify, and a start failure with "Try again"
  • Angular's sanitizer marks otpauth: links unsafe, so the href is set directly, and only for an otpauth:// URL. That avoids a new @angular/platform-browser peer dependency.
• Sign-in:
  • SaFallbackOptions gains an offerAuthenticator input (off by default) and an authenticator output.
  • SaLogin turns it on whenever a sign-in is in progress.
• register-passkey:
  • A recovery session gets the recovery copy, cannot skip, and is always offered the app.
  • Outside recovery, the app is offered on a device without passkeys only when a non-passkey method is enabled. A passkey-only application refuses authenticator sign-in.
• Settings: new router-independent SaAuthenticatorAppSettings (exported from @seamless-auth/angular/routes). It shows status and last use, sets up an app inline, and turns it off with a current code.
• Service: gains a recoverySession signal.

Step-up prompts are out of scope here. The Angular binding prompts for step-up nowhere yet, and the README says so.

Tests

• 17 new tests in screens.test.ts: sign-in, enrollment, and the authenticator options on register-passkey.
• 6 tests in the new authenticatorAppSettings.test.ts.

Checks

lint, typecheck (ngc), format:check, build (with finalize-angular-dist) and test (jest 807 passed, vitest 42 passed) all pass.