fix(auth): exempt credential-recovery routes from the onboarding gate

WHY THIS MATTERS
A user who signs up, reaches onboarding, and closes the tab has
onboarding_version = NULL. If that user later forgets their password,
the recovery email link logs them in and lands on /reset-password -
but OnboardingGate saw an authenticated, un-onboarded user on a
non-exempt route and immediately replaced the URL with
/onboarding/profile. The reset form never rendered, the password never
changed, and the next login failed again: a permanent lockout loop.

Replicated live during the PR #365 review: with onboarding_version set
to NULL, navigating to /reset-password with a session redirects to
/onboarding/profile before the form paints.

WHAT IS A ROUTE-GATE EXEMPTION LIST
OnboardingGate wraps every page and decides "does this user belong in
onboarding right now?". Pages that are themselves part of an auth
transition (login, signup, the OAuth callback) are listed as exempt so
the gate never fights the auth flow. The bug was that the list only
covered the *entry* flows; the *recovery* flows (/reset-password,
/forgot-password, /verify-mfa) also run with a session that must not
be interrupted.

HOW THE FIX WORKS
The three credential-recovery routes join the exemption list, so a
recovery session can finish its job before onboarding resumes on the
next normal navigation. A parameterised test pins each route as
reachable for an un-onboarded user.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RuPCULDYgVsiCanRgbEy6W