🔐 feat: Recover Code API Machine Credentials After Outages

[lia-by-librechat]

Summary

• Persist key-bound machine enrollment separately from short-lived worker credentials when CODEAPI_BRIDGE_RECOVERY_SERVER_ID is enabled.
• Add signed single-use recovery challenges bound to the server, worker, enrollment generation, and operation; issue credentials and revoke atomically in shared Redis.
• Preserve legacy pairing and refresh, principal bindings, worker identity, and all quarantine and assignment fences. Fail closed if enrollment is missing or superseded.

Rollout

Deploy compatible Code API replicas first, configure an identical HTTPS origin and persistent Redis, then re-enroll existing workers once. Browser device approval and automatic CLI reconnect are separate follow-up PRs. This change is disabled by default and does not change execution permissions.

Checks

• Focused Bun recovery, pairing and HTTP router tests
• Targeted service tsc --noEmit; packages/code tsc --noEmit
• Changed service file ESLint with the existing while (true) rule excluded; git diff --check

Full service typechecks and router lint have pre-existing diagnostics outside the new recovery logic.