[ege-arhan]

Summary

This is the recovery-only replacement for #4, scoped to feature/auto-session-recovery so the changes can flow through Lampese#192 without adding unrelated providers, themes or localization.

• Serialize recovery, ignore superseded detections, and back off pending launches instead of repeating continuation messages.
• Prefer the Desktop owner's IPC bridge for continuation so a second writer does not lock the conversation.
• Preserve the Linux parent-node-wrapper termination check/fallback and non-goal CLI queue-resume fallback. Capture process identity at discovery and check it before Unix signals and pending retries to guard against PID reuse.
• Keep RoundRobin useful when usage checks temporarily fail, while skipping accounts confirmed exhausted.
• Only auto_recovery.rs and minimal backend/frontend recovery event wiring are included.

No Claude/Cursor/Grok modules, theme/localization changes or design artifacts. The installed personal build is untouched.

Verification

• cargo test --lib auto_recovery: 37 passed (including IPC one-delivery, concurrency, timestamp, RoundRobin transient failure, process identity and wrapper tests).
• pnpm build: passed.
• Changed Rust files: rustfmt passed; git diff --check: clean.
• Fixed a pre-existing date-dependent selection test fixture to use the current time without changing account selection policy.

Limits / review notes

• No live account switch was performed and no installed app or user process was changed during this extraction.
• Native Linux/Windows recovery paths still need maintainer runtime smoke testing; tests ran on macOS.
• Desktop continuation uses the current private owner IPC protocol and fails with a notification if it changes. Ambiguous delivery is not resent.
• Unix process identity checks reduce PID reuse risk but cannot make an external kill atomic; macOS ps start time has second precision.
• Account selection preserves this branch's eligibility policy, including RoundRobin fallback on unknown usage; the personal build's additional paid-plan policy is not silently imposed here.

Related independent upstream work: themes Lampese#213; provider scope RFC Lampese#212. This PR does not depend on either.