Refactor envelope receiver auth flow and state handling

- Introduce IReceiverAuthService and ReceiverAuthService for all envelope receiver authentication and status API calls
- Add ReceiverAuthModel as a client-side DTO for API responses
- Refactor EnvelopeState to store all relevant fields and update via ApplyApiResponse
- Overhaul EnvelopePage.razor to use new service and state, with improved status handling and UI
- Enhance ApiResponse and ApiServiceBase to support structured error deserialization
- Register IReceiverAuthService in DI container

EnvelopeGenerator.ReceiverUI/EnvelopeGenerator.ReceiverUI.Client/Services/ReceiverAuthService.cs

@@ -0,0 +1,41 @@
+using EnvelopeGenerator.ReceiverUI.Client.Models;
+using EnvelopeGenerator.ReceiverUI.Client.Services.Base;
+
+namespace EnvelopeGenerator.ReceiverUI.Client.Services;
+
+/// <summary>
+/// Spricht mit dem ReceiverAuthController der API.
+/// 
+/// Nutzt die Basisklasse ApiServiceBase für einheitliches Error-Handling.
+/// Jede Methode gibt ApiResponse&lt;ReceiverAuthModel&gt; zurück —
+/// egal ob Erfolg oder Fehler. Die aufrufende Komponente prüft dann
+/// result.IsSuccess und result.Data.Status.
+/// 
+/// WARUM gibt die API bei 401 trotzdem ein ReceiverAuthModel zurück?
+/// Weil auch bei "falscher Code" der Client wissen muss, welchen
+/// Status er anzeigen soll (z.B. "requires_access_code" + ErrorMessage).
+/// Deshalb deserialisieren wir auch bei Fehler-Statuscodes den Body.
+/// </summary>
+public class ReceiverAuthService : ApiServiceBase, IReceiverAuthService
+{
+    public ReceiverAuthService(HttpClient http, ILogger<ReceiverAuthService> logger)
+        : base(http, logger) { }
+
+    public Task<ApiResponse<ReceiverAuthModel>> GetStatusAsync(
+        string key, CancellationToken ct = default)
+        => GetAsync<ReceiverAuthModel>($"api/receiverauth/{key}/status", ct);
+
+    public Task<ApiResponse<ReceiverAuthModel>> SubmitAccessCodeAsync(
+        string key, string accessCode, bool preferSms, CancellationToken ct = default)
+        => PostAsync<object, ReceiverAuthModel>(
+            $"api/receiverauth/{key}/access-code",
+            new { AccessCode = accessCode, PreferSms = preferSms },
+            ct);
+
+    public Task<ApiResponse<ReceiverAuthModel>> SubmitTfaCodeAsync(
+        string key, string code, string type, CancellationToken ct = default)
+        => PostAsync<object, ReceiverAuthModel>(
+            $"api/receiverauth/{key}/tfa",
+            new { Code = code, Type = type },
+            ct);
+}