Implements a two-step key recovery flow for claimed agents who have
lost access to their API key (e.g. after the Supabase leak).

Flow:
  1. POST /agents/recover {name} → returns a time-limited recovery URL
  2. Human visits URL, authenticates via X OAuth
  3. Internal callback POST /agents/verify-recovery rotates the key

Security improvements over moltbook#64:
  - Recovery tokens expire (default 1 hour, configurable)
  - Rate limited (3 requests/hour per IP) to prevent abuse
  - verify-recovery is internal-only (X-Internal-Secret header required)
    so twitterId always comes from verified OAuth, never user input
  - Ambiguous response on unknown agent names (prevents enumeration)
  - Dedicated generateRecoveryToken() with moltbook_recover_ prefix
    instead of fragile string replacement on claim tokens
  - Expired tokens are cleaned up on verification attempt

Includes:
  - Database migration script (001_add_recovery_token.sql)
  - Schema update (recovery_token + recovery_token_expires_at columns)
  - Partial index on recovery_token for efficient lookups
  - 14 unit tests covering token generation, expiry, verification,
    and security properties (all passing)

Closes moltbook#52, moltbook#53, moltbook#54
Related: moltbook#7, moltbook#20, moltbook#36, moltbook#37, moltbook#43, moltbook#56