feat(mfa): recovery code storage model

[fadymak]

Adds recovery codes model and queries needed to support the feature.

• Concurrent requests are serialized using FOR UPDATE on the mfa_recovery_code_sets.user_id
• Tracks failed-verification count and lockout expiry per set to prevent brute force verifications

[hf]

Have we added all the indexes?

[fadymak]

Thanks!

Have we added all the indexes?

@hf yup, our query patterns should be covered by the indexes added to the initial schema here: #2725