feat(totp): 4-part defense against permanent lockout

- credential-manager.js: add diagnose(key) method that distinguishes
  ok | missing | unreadable | corrupt instead of silently returning null
- crypto-utils.js: silent fallback to .encryption-key.bak when primary
  can't decrypt existing credentials; first-run bootstrap writes .bak;
  rotateKey() backs up old key before swap
- routes/auth/totp.js: new public /api/v1/totp/recovery-info endpoint
  returns {status, isSetUp, hint} so UI can show meaningful errors
- middleware.js: add /totp/recovery-info to PUBLIC_ROUTES so the
  locked-out user can read the diagnostic without being logged in

dashcaddy-api/middleware.js

@@ -283,6 +283,7 @@ module.exports = function configureMiddleware(app, {
     { path: '/probe/',                   prefix: true },
     { path: '/api/v1/tailscale/',        prefix: true },
     { path: '/api/v1/totp/config',        exact: true,  method: 'GET' },
+    { path: '/api/v1/totp/recovery-info', exact: true,  method: 'GET' },
     { path: '/api/v1/totp/verify',        exact: true },
     { path: '/api/v1/totp/setup',         exact: true,  method: 'POST' },
     { path: '/api/v1/totp/verify-setup',  exact: true,  method: 'POST' },