[Bccorb]

Closes #216. Stacked on #218 (shared client pieces); merge that first.

Summary

Authenticator app (TOTP) screens for the Svelte binding.

• Screens: authRoutePaths adds two new screens:
  • SaRegisterAuthenticator (/register-authenticator) shows a QR code from qrCode(), the setup key with a copy button, and an otpauth:// link (only for an otpauth:// URL). It verifies the first code, ends on a success state, then continues where SaRegisterPasskey does. "Back" keeps returnTo.
  • SaAuthenticatorCode (/authenticator-code) signs in with signInWithTotp. It explains a wrong or reused code, a lockout and a rate limit.
• Sign-in:
  • SaFallbackOptions gains an optional onAuthenticatorApp.
  • SaLogin passes it, so the option appears whenever a pre-auth sign-in falls back.
• SaRegisterPasskey:
  • A recovery session can no longer skip, and is always offered the app, with its own copy on a device without passkeys.
  • Outside recovery, the app is offered on a device without passkeys only when skipping is allowed. A passkey-only application refuses authenticator sign-in.
• Settings: new router-free SaAuthenticatorAppSettings. It shows status, sets up an app with Cancel, and turns it off with a current code.
• Exports: the three new components and TotpStatus.

Step-up prompts are out of scope here. The Svelte binding prompts for step-up nowhere yet.

Tests

16 new vitest cases:

• the login offer
• sign-in: success, short code, wrong code, lockout, 429 and back
• enrollment: QR, key, link, copy, verify, success, returnTo, a refused code, copy failure and back
• secret_required then retry, and no link for a non-otpauth URL
• the unsupported-device offer, and its absence for a passkey-only application
• a recovery session with no skip that ends with recoverySession false, and one without passkeys
• settings: set up, cancel, turn off with a wrong then right code, and a load failure with retry

Checks

lint, typecheck (svelte-check), format:check, build (with finalize-svelte-dist) and test (jest 784 passed, vitest 56 passed) all pass.