🔑 feat: Recover Enrolled Worker Credentials On Startup

[lia-by-librechat]

Summary

Start slice 2 with automatic startup recovery. A worker stopped past its access-credential lifetime currently exits on refresh rejection even when Code API still holds its durable machine enrollment.

• On startup only, a typed CREDENTIAL_INVALID refresh rejection invokes Code API's existing signed challenge/recovery flow.
• Reuse the locally enrolled key, exact HTTPS server origin, and existing worker identity. Persist the recovered credential before adoption or registration.
• Share the refresh deadline and cancellation across recovery requests. Bound responses and refuse redirects, mismatched challenge context, and invalid recovered credentials.
• Keep active-work auth failures, revocation, quarantine, static auth, and ordinary refresh behavior unchanged. Older/disabled servers explain the pairing fallback instead of retrying forever.

Independent of #339. This PR is the recovery portion of slice 2, not the status/doctor commands. Browser/OAuth approval from slice 1 is still outstanding.

Verification

• Focused worker recovery, refresh, concurrency, and quarantine tests: 179 passed on Node 24.16.0, without a storage fixture.
• npm run build and npx --no-install tsc --noEmit: passed in packages/code.
• Existing Code API recovery routes/proofs reused unchanged. No new enrollment endpoint or stored identity format.

Independent review

Reviewed head: 2682b1cc361ce94f65331ea9f73550bc816e85a2. Complete, no findings. Reviewer ran 47 recovery tests and 25 selected regressions with direct TypeScript execution. No live Code API/Redis/TLS restart test was performed.

[lia-by-librechat]

Review head: 2682b1c. Startup-only signed credential recovery for existing enrollment, persistence-before-adoption, bounded transport, and denial/cancellation/quarantine regression coverage. Independent of the guided setup PR #339.

[lia-by-librechat]

Independent review completed for 2682b1c: no findings. Local build, no-emit typecheck, formatting, and 179 focused worker tests passed without a storage fixture. Live Code API/Redis/TLS restart verification was not run.