Backup codes are saved before user intends

Currently, clicking the Generate verification codes button will generate codes and save them to usermeta. I think most users will only expect the codes to be saved if they click the Update Profile button.

If they navigate away from the page without clicking that, they'll assume nothing has changed, but in reality it has. This can be a problem if they already had existing codes, and accidentally clicked the button, or clicked it intentionally but then decided they didn't want new codes. Their old codes are now invalid, but they don't know that and won't save the new ones. They could be locked out in the future because their saved codes no longer work.

Start from the WordPress profile flow behind the Generate verification codes button and trace where the generated codes are written to usermeta. Verify the existing behavior for navigating away and for clicking Update Profile; done means codes are not persisted until the profile is updated, so existing codes remain valid if the user abandons the change.