feat: deliver account recovery notices and pass through the v0.20 recovery routes #13

Auth API v0.20 (fells-code/seamless-auth-api#500, @seamless-auth/types 0.31.0) adds owner notices for account recovery that an adapter owning delivery must send. The work matches seamless-auth-server#232 and seamless-auth-go#11.

• Delivery: handle account_notice_email (to, subject, text, notice, cancelUrl?) and account_notice_sms (to, text, notice, cancelUrl?). cancelUrl carries a credential: send it only to to, never log it.
• On manifest routes marked notices: true (today POST /recovery/verify):
  • Send external delivery plus x-seamless-auth-delivery-kinds: account_notice_email,account_notice_sms.
  • Deliver every item in the response's deliveries array, and strip it before answering.
  • Only send the header if every listed kind is delivered, because the API counts a returned notice as the owner being told.
• otp_email / otp_sms may carry purpose: 'account_recovery': word that message as a recovery warning.
• Pass through 503 recovery_notice_failed from /recovery/verify, and the new access routes GET /recovery/requests and DELETE /recovery/requests/:id.
• Unknown delivery kinds stay a logged no-op, not a crash.