feat(mfa): add recovery codes status and generate endpoints

[fadymak]

Adds the recovery codes status and generation endpoints.

• GET /factors/recovery-codes for status and counts
• POST /factors/recovery-codes for creating the verified factor and returning the codes
  • Codes are only returned once in canonical form

Note

The codes are returned unformatted (e.g.: abcdefgh). We leave it up to the client to decide how to display the codes since the code lengths could vary and we shouldn't be enforcing any grouping or separators (e.g.: ABCD-EFGH)
However, we normalize the accepted values (lower cased, hyphens and spaces stripped)

Status endpoint

GET /factors/recovery-codes
Authorization: Bearer <access-token>

Response (counts only, never codes):

{
  "id": "b3f1c2a4-...",
  "type": "recovery_code",
  "total": 10,
  "remaining": 9
}

Returns 404 mfa_factor_not_found when no set is enrolled.

Generate endpoint

POST /factors/recovery-codes
Authorization: Bearer <aal2-access-token>

{ "friendly_name": "My recovery codes" }

The body is optional: a missing or blank friendly_name defaults to "Recovery codes".

Response (plaintext codes shown once, in canonical form):

{
  "id": "b3f1c2a4-...",
  "type": "recovery_code",
  "friendly_name": "My recovery codes",
  "total": 10,
  "codes": ["k4m9x7qp2ab8ht3z", "9wze6r5npd4cmq7v", "…8 more…"]
}