Establish hardware-backed authorization recovery

[cbusillo]

Summary

• add hardware-backed OpenSSH SSHSIG authorization bootstrap, recovery, and key rotation
• keep public total-lockout ingress credential-free and code-bounded to one fixed GitHub-human policy-admin rule
• add signed-in browser key lifecycle, HTTP-only operator CLI, redacted audit/alert evidence, and an engineering UI with no recovery execution control
• enforce atomic policy/challenge/bootstrap/rotation/outbox writes plus distinct custody slots and distinct live public-key fingerprints
• bound unauthenticated challenge capacity per signing key and deduplicate rejected-attempt evidence

Safety

• no GitHub Actions authority, workflow grant, static bearer, private-key storage, policy upload, or direct live-DB path
• public routes reject Authorization and Cookie; browser mutations require GitHub-human session, same-origin fetch metadata, and single-use CSRF
• recovery re-plans and revalidates the exact active policy, candidate digest, signer, replay/expiry state, and operation invariants inside one serialized transaction
• initial bootstrap is monotonic; restore may replace only the fixed recovery administrator ID; rotation requires a different active signer

Validation

• uv run --extra dev launchplane ci unittest-shard local — 3,105 targets, 12/12 shards
• uv run --extra dev mypy control_plane tests
• changed/untracked Python Ruff lint and format checks
• focused recovery HTTP, service, storage, migration, session, outbox, and contract tests
• pnpm --dir frontend validate
• pnpm --dir frontend test:browser — 98 journeys at desktop and narrow widths
• config-authority audit and JetBrains changed-files inspection; only repository-preexisting large-file warnings remain
• independent security/architecture review approved after blocker remediation

Refs #2239