Auth

This is a release candidate. See release-please PR #2817 for context.

Adds MFA recovery codes with crypto primitives, factor model, schema, and endpoints for generate, status, verify, regenerate, and delete. Also adds SCIM users/tokens tables, an expires_at column to one_time_tokens, and OAuth server token exchange metering events.