Add backup codes, password reset, and a PostgreSQL store backendVerified

- Credential abstraction in the store protocol (cred put/get/del/add/list/
  consume, keyed by subject+kind). TOTP secrets, backup codes, and email/
  reset tokens move off the user struct into credentials.
- TOTP backup/recovery codes: single-use, hashed, issued at confirm and via
  POST /totp/backup-codes; accepted as a fallback in the 2FA step.
- Password reset email: request-password-reset + reset-password (single-use
  hashed token, Argon2 rehash), enumeration-safe handler; /reset-password[/request].
- PostgreSQL backend (postmodern): full store protocol incl. usher_credentials,
  parameterized queries, atomic code consume + refresh rotate/reuse. Wired via
  config :db; verified end-to-end against a live Postgres (test/pg-smoke.lisp).

98 in-memory checks pass; PG smoke (18 checks) passes against real Postgres.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>