feat(auth): add trusted-device 30-day 2FA skip (backend)

Adds a "trust this device" option to the 2FA challenge: on success, mints a
random token (only its SHA-256 hash is stored), sets it as a new httpOnly,
Secure, SameSite=Strict cookie, and records a TrustedDevice row. AuthController
checks that cookie for the exact signing-in user before gating on 2FA -- a
mismatched user, expired, or revoked device falls through to the normal 2FA
prompt, never errors. TwoFactorController also exposes list/revoke/revoke-all
endpoints for managing trusted devices, scoped to the owning user.

Schema added via the existing raw-SQL reconciler (SQLite + MySQL dialects),
not EF migrations, matching this repo's established pattern.

JobTrackerApi/Services/AuthSessionOptions.cs

@@ -7,6 +7,7 @@ public static class AuthSessionOptions
     public const string SessionCookieName = "jobtracker_auth";
     public const string CsrfCookieName = "XSRF-TOKEN";
     public const string CsrfHeaderName = "X-CSRF-TOKEN";
+    public const string TrustedDeviceCookieName = "jobtracker_td";
 
     public static CookieOptions BuildSessionCookie(bool persistent, bool secure)
     {
@@ -75,4 +76,35 @@ public static class AuthSessionOptions
             MaxAge = TimeSpan.Zero,
         };
     }
+
+    // Stricter than the session cookie (SameSite=Strict, never HttpOnly=false): this cookie's
+    // only job is "skip the 2FA prompt", so it must never be readable by JS and should not even
+    // be sent on cross-site navigations.
+    public static CookieOptions BuildTrustedDeviceCookie(bool secure)
+    {
+        return new CookieOptions
+        {
+            HttpOnly = true,
+            IsEssential = true,
+            SameSite = SameSiteMode.Strict,
+            Secure = secure,
+            Path = "/",
+            Expires = DateTimeOffset.UtcNow.AddDays(30),
+            MaxAge = TimeSpan.FromDays(30),
+        };
+    }
+
+    public static CookieOptions BuildExpiredTrustedDeviceCookie(bool secure)
+    {
+        return new CookieOptions
+        {
+            HttpOnly = true,
+            IsEssential = true,
+            SameSite = SameSiteMode.Strict,
+            Secure = secure,
+            Path = "/",
+            Expires = DateTimeOffset.UnixEpoch,
+            MaxAge = TimeSpan.Zero,
+        };
+    }
 }