[Bccorb]

Closes #214. Stacked on #218 (shared client pieces); merge that first.

Summary

Authenticator app (TOTP) screens for the Vue binding.

• Routes: createSeamlessAuthRoutes() adds two new screens:
  • register-authenticator (SaRegisterAuthenticator) shows a QR code from qrCode(), the setup key in groups of four with a copy button, and an otpauth:// link (only for an otpauth:// URL). It verifies the first code, shows a success state, then continues where SaRegisterPasskey does (returnTo through safeReturnPath, else signedInPath).
  • authenticator-code (SaAuthenticatorCode) signs in with signInWithTotp.
• Sign-in:
  • SaFallbackOptions gains an offerAuthenticatorApp prop and an authenticatorApp event.
  • SaLogin always offers "Use an authenticator app" once a sign-in has started. The API answers a code for any identifier, so this reveals nothing.
• SaRegisterPasskey:
  • A recovery session can no longer skip, and is always offered an authenticator app.
  • Outside recovery, the app is offered on a device without passkeys only when skipping is allowed. A passkey-only application refuses authenticator sign-in.
• Settings: new router-free SaAuthenticatorAppSettings, exported from the package root. It shows status, sets up an app inline, and turns it off with a current code.
• Plugin: useSeamlessAuth() exposes recoverySession, and the root re-exports TotpStatus.
• Error copy: comes from totpErrorMessage (wrong or reused code, lockout, rate limit, passkey-only, missing server key).

Step-up prompts are out of scope here. The Vue binding prompts for step-up nowhere yet.

Tests

screens.test.ts covers:

• sign-in: success, wrong code, lockout, rate limit and back
• a full recovery-session enrollment on a device without passkeys, including copy success and failure, empty and wrong codes, and returnTo
• the offer and no-skip rules with and without passkey support, including a passkey-only application
• start failures and retry
• no link for a non-otpauth URL
• signedInPath
• the settings component end to end

Checks

lint, typecheck, format:check, build (with check-vue-dist) and test (jest 793 passed, vitest 42 passed) all pass.