feat(auth): add trusted-device 30-day 2FA skip (backend)

Adds a "trust this device" option to the 2FA challenge: on success, mints a
random token (only its SHA-256 hash is stored), sets it as a new httpOnly,
Secure, SameSite=Strict cookie, and records a TrustedDevice row. AuthController
checks that cookie for the exact signing-in user before gating on 2FA -- a
mismatched user, expired, or revoked device falls through to the normal 2FA
prompt, never errors. TwoFactorController also exposes list/revoke/revoke-all
endpoints for managing trusted devices, scoped to the owning user.

Schema added via the existing raw-SQL reconciler (SQLite + MySQL dialects),
not EF migrations, matching this repo's established pattern.

JobTrackerApi/Controllers/AuthController.cs

@@ -1,5 +1,6 @@
 using System.Text.Json;
 using System.Security.Claims;
+using JobTrackerApi.Data;
 using JobTrackerApi.Models;
 using JobTrackerApi.Services;
 using Microsoft.AspNetCore.Authorization;
@@ -22,8 +23,9 @@ public sealed class AuthController : ControllerBase
     private readonly IMicrosoftTokenValidator _microsoftTokens;
     private readonly ILogger<AuthController> _logger;
     private readonly ITwoFactorPendingTokenService _twoFactorPending;
+    private readonly JobTrackerContext _db;
 
-    public AuthController(IConfiguration cfg, UserManager<ApplicationUser> users, ITokenService tokens, IAppEmailSender email, IGoogleTokenValidator googleTokens, IMicrosoftTokenValidator microsoftTokens, ILogger<AuthController> logger, ITwoFactorPendingTokenService twoFactorPending)
+    public AuthController(IConfiguration cfg, UserManager<ApplicationUser> users, ITokenService tokens, IAppEmailSender email, IGoogleTokenValidator googleTokens, IMicrosoftTokenValidator microsoftTokens, ILogger<AuthController> logger, ITwoFactorPendingTokenService twoFactorPending, JobTrackerContext db)
     {
         _cfg = cfg;
         _users = users;
@@ -33,6 +35,7 @@ public sealed class AuthController : ControllerBase
         _microsoftTokens = microsoftTokens;
         _logger = logger;
         _twoFactorPending = twoFactorPending;
+        _db = db;
     }
 
     [HttpGet("config")]
@@ -671,6 +674,16 @@ public sealed class AuthController : ControllerBase
     // decorative: skipping straight to AppSessionIssuer here would defeat the whole feature.
     private async Task<IActionResult> CompleteSignInAsync(ApplicationUser user, bool rememberMe, string provider, CancellationToken cancellationToken)
     {
+        // "Trust this device" cookie check happens BEFORE the 2FA gate: if it matches a
+        // non-expired row for this exact user, skip straight to a real session, same as if 2FA
+        // weren't required at all. Falls through to the normal gate for any other outcome
+        // (no cookie, wrong user, expired, revoked) -- never errors, just doesn't skip.
+        if (user.TwoFactorEnabled && await TrustedDeviceService.IsDeviceTrustedAsync(_db, Request, user.Id, cancellationToken))
+        {
+            await AppSessionIssuer.IssueAsync(Request, Response, _tokens, user, rememberMe, cancellationToken);
+            return Ok(new AuthSessionResult(true, provider));
+        }
+
         if (user.TwoFactorEnabled)
         {
             var pendingToken = _twoFactorPending.IssuePendingToken(user.Id, rememberMe);