Add custom recovery passphrase setup flow

When the homeserver advertises custom_recovery_passphrase_settings (and
the enterprise gate is enabled), the secure-backup setup lets the user
enter and confirm their own recovery key with a live strength indicator,
instead of receiving a generated one. The SDK derives the 4S key from the
passphrase and the base58 key is scrubbed everywhere so it is never
shown. Falls back to the generated-key flow when no spec is present or
the well-known fetch fails.

Snapshot PNGs are intentionally left out; the core team regenerates them
after the PR is opened.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

libraries/testtags/src/main/kotlin/io/element/android/libraries/testtags/TestTags.kt

@@ -29,6 +29,8 @@ object TestTags {
      * Verification screen.
      */
     val recoveryKey = TestTag("verification-recovery_key")
+    val customRecoveryPassphrase = TestTag("verification-custom_recovery_passphrase")
+    val customRecoveryPassphraseConfirm = TestTag("verification-custom_recovery_passphrase_confirm")
 
     /**
      * Sign out screen.