feat(auth): add admin-approved account recovery Users who lose access to their registered email and WhatsApp cannot recover the existing account when their NIK is already in use. Add a public signed-letter recovery workflow and an admin review queue. - `/pemulihan-akun` collects KTP details, a reachable WhatsApp number, optional replacement email, and one signed PDF containing the letter and KTP copy. Applicants can download a letter template and retain a receipt link showing only decision status. - `/admin/user/pemulihan` requires a live, non-impersonated admin session with TOTP. Approval requires independent identity and contact checks, updates the original account atomically, records the decision, and revokes old sessions, OAuth tokens, reset links, and trusted-device challenges. Existing TOTP, identity verification, and tax links are preserved. Privileged accounts retain their internal recovery procedure. - Deliver the account email and generated password through a dedicated OCA template. Encrypt pending credentials, keep them out of logs and action responses, and permit explicit retries for 24 hours. Retries refuse credentials superseded by account changes. Replacement email addresses still require verification. ## Release impact Minor. Introduce a distinct identity-evidence and admin-approval recovery capability for applicants who cannot use the existing email password-reset flow. ## Validation - UI policy checks pass against base `a3b6d91ee6`. - React Doctor changed audit passes with zero errors, zero warnings, and a complete baseline comparison. Local temporary files were moved out of quota-constrained `/tmp`. - Focused TypeScript checking and ESLint pass for the recovery implementation. The full repository typecheck exceeded local memory, so validation was narrowed to affected routes, modules, and their imports. - The generated letter was rendered and visually checked; migration SQL was compared with the new Drizzle snapshot without connecting to a database. - Added nine regression cases for authorization, duplicate/corrected requests, revocation, TOTP preservation, email replacement, rejection, NIK relinking, and rollback. Tests, builds, and dev servers were not run, as requested. ## Rollout Apply `drizzle/0206_account_recovery.sql` before serving the new routes. Configure `WHATSAPP_BIZ_OCA_TEMPLATE_CODE_ACCOUNT_RECOVERY` with exactly four body variables: applicant name, request ID, account email, and generated password. Existing OCA endpoint/token and Resend settings are required. Keep `BETTER_AUTH_SECRET` stable while delivery is pending. Approval is blocked without WhatsApp configuration. No migrations, live account changes, or notifications were executed during development. Closes #1821 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **New Features** * Added an account-recovery option for people who have lost access to their email or WhatsApp. Applicants can provide identity and contact details, download a recovery letter, upload the completed letter and ID as a PDF, and track their request status. * Administrators can review requests, approve or reject them, and retry delivery of approved recovery credentials when available. * Added a link to account recovery from the password-reset page. * **Documentation** * Added setup guidance for account-recovery configuration and WhatsApp messaging. <!-- end of auto-generated comment: release notes by coderabbit.ai -->