feat: implement account recovery with encrypted backup bundles

Add recovery code generation (8 codes per setup), Argon2id key derivation,
ChaCha20-Poly1305 encrypted bundles, and server-side zero-knowledge storage.
Each code independently recovers the account. Includes core crypto module,
protobuf service (method IDs 750-752), server domain + handlers, SDK methods,
SQL migration, and CLI commands (/recovery setup, /recovery restore).

crates/quicproquo-server/migrations/011_recovery_bundles.sql

@@ -0,0 +1,7 @@
+-- Recovery bundle storage: encrypted bundles keyed by token_hash.
+CREATE TABLE IF NOT EXISTS recovery_bundles (
+    token_hash BLOB PRIMARY KEY,
+    bundle     BLOB NOT NULL,
+    ttl_secs   INTEGER NOT NULL DEFAULT 0,
+    created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
+);