Provide Recovery Codes for 2FA users

### Description

We have added support for 2FA via #3065

This allows a user to setup TOTP-based 2FA. However, if they lose their authenticator device, the only route they have to recover is to contact support/admin and have them disable 2FA on their account. This is not ideal.

It is fairly standard to provide users a set of one-time use recovery codes as part of the 2FA setup. These codes can be used in place of a true 6-digit TOTP code - but only once. This would give users a way to recover their account securely.

### Epic/Story

#3065

### Have you provided an initial effort estimate for this issue?

I have provided an initial effort estimate

Start by reviewing the 2FA support introduced in #3065 and trace the existing TOTP setup and verification flow. The work is done when setup provides one-time recovery codes, those codes are accepted in place of a 6-digit TOTP code only once, and users can recover access without administrator intervention.

Written by the indexing model from the issue text.