Disabling 2FA with recovery codes fails because NPM expects only digits

Checklist

• Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
  • Yes / No
• Are you sure you're not using someone else's docker image?
  • Yes / No
• Have you searched for similar issues (both open and closed)?
  • Yes / No

Describe the bug

Somehow my authentication manager (apple passwords) forgot that I had setup 2FA (really weird). So I used a recovery code to login which worked. Then I wanted to disable 2FA to redo the process. It asks for a code, which I dont have and does not accept any of the recovery codes since it contains characters. It feels like I cant continue. I can manage for now, but once I run out of recovery codes I'm screwed.

Nginx Proxy Manager Version

v2.14.0

To Reproduce
Steps to reproduce the behavior:

1. Login with username and password
2. Get asked for verification code and enter a recovery code
3. Successfully logged in and at homepage
4. Click on account in the right top corner
5. Click on Two-Factor Auth
6. Click on Disable two factor authentication
7. Enter the recovery codes in the textbox
8. Click disable 2fa
9. See error Internal error
10. Check logs to see the following real error: [Express ] › ⚠ warning Token must contain only digits!

-- A clear and concise description of what you expected to happen. -->
I expect it to disable 2FA with recovery codes

Operating System
TrueNas Scale. As an app from the catalogue.

Additional context
If needed I can get some info from the app catalogue.

Start at the account's Two-Factor Auth disable flow and trace the request that produces Express's “Token must contain only digits!” warning. Compare the recovery-code path used during login with the disable request; done means a valid recovery code disables 2FA without the internal error, while digit-based codes retain their behavior.