fix: make Review Recovery UI delivery fail closed

[AllenXiao95]

Follow-up to #47 / #46 after real Windows Dashboard validation showed that the Recovery backend and static asset were present but the served / page could still omit the Recovery function area silently.

This change makes Recovery UI delivery mandatory at the public dashboard server boundary:

• preserves the existing HTTP server implementation unchanged in server_impl.py;
• public server.py re-exports the historical module surface so existing imports continue to work;
• / injects review-recovery.js explicitly and fail-closed;
• if the Recovery asset is missing, Dashboard returns HTTP 500 missing_asset instead of silently serving a reduced UI;
• if index.html cannot accept the injection, it fails with invalid_asset;
• all existing entrypoints (localizer dashboard, python -m localizer.cli.main, tests) use the patched request handler.

The existing Recovery HTTP smoke test now exercises this public facade and must still find 变更历史 / Recovery in the served HTML.

This is intentionally a delivery fix only; no Review/TM recovery semantics change.

Refs #46