feat(status): TOTP recovery UI - panel, backup download, always-visible Import

- status/js/totp-recovery.js: NEW. Wires up recovery panel on the TOTP
  gate. Pastes Base32 -> /api/v1/totp/setup -> /verify-setup -> session.
  Exposes window._refreshRecoveryLink() called by totp-auth.js.
- status/js/totp-auth.js: showTotpOverlay() now calls
  _refreshRecoveryLink() so the recovery link hides when TOTP is healthy
  and appears when it's broken.
- status/js/totp-settings.js: removed setupSection.style.display='none'
  so 'Import existing secret' is always visible; added 'Download backup
  file' button after setup that exports the Base32 + recovery
  instructions as JSON.
- status/index.html: added 'Lost access? Recover with saved Base32
  key ->' link to the TOTP overlay plus the recovery panel itself;
  added title tooltip to the auth card reminding users to save the
  Base32 on first setup.
- status/build.js: include JS('totp-recovery.js') in the core bundle
  after totp-auth.js (since recovery registers a hook auth calls).

status/build.js

@@ -19,6 +19,9 @@ const bundles = {
     JS('skeleton-loader.js'),
     JS('theme.js'),
     JS('totp-auth.js'),
+    // totp-recovery.js registers window._refreshRecoveryLink which totp-auth.js
+    // calls from showTotpOverlay(). Must come after totp-auth.js.
+    JS('totp-recovery.js'),
     JS('service-credentials.js'),
     JS('totp-settings.js'),
     JS('core', 'credentials.js'),