feat(auth): add trusted-device 30-day 2FA skip (backend)

Adds a "trust this device" option to the 2FA challenge: on success, mints a
random token (only its SHA-256 hash is stored), sets it as a new httpOnly,
Secure, SameSite=Strict cookie, and records a TrustedDevice row. AuthController
checks that cookie for the exact signing-in user before gating on 2FA -- a
mismatched user, expired, or revoked device falls through to the normal 2FA
prompt, never errors. TwoFactorController also exposes list/revoke/revoke-all
endpoints for managing trusted devices, scoped to the owning user.

Schema added via the existing raw-SQL reconciler (SQLite + MySQL dialects),
not EF migrations, matching this repo's established pattern.

Models/TrustedDevice.cs

@@ -0,0 +1,16 @@
+namespace JobTrackerApi.Models;
+
+// "Trust this device for 30 days" -- lets a browser skip the 2FA code step after one successful
+// challenge. Never store the plaintext token, only its SHA-256 hash, same rationale as
+// TwoFactorRecoveryCode.CodeHash: a DB read (backup, replica, leaked snapshot) can't be turned
+// into a working cookie.
+public sealed class TrustedDevice
+{
+    public int Id { get; set; }
+    public string UserId { get; set; } = "";
+    public string TokenHash { get; set; } = "";
+    public string? DeviceLabel { get; set; }
+    public DateTimeOffset CreatedAtUtc { get; set; }
+    public DateTimeOffset LastSeenAtUtc { get; set; }
+    public DateTimeOffset ExpiresAtUtc { get; set; }
+}