Normalize malformed primary-provider meta before array-key access

Problem

Malformed _two_factor_provider user meta can reach provider-array offset access without scalar validation. With at least two available providers, setting the primary value to an object, array, or nested array causes a fatal/warning during primary resolution.

Reproduction

1. Configure two available providers for a user.
2. Set _two_factor_provider to stdClass, an array, or a nested array.
3. Resolve the user primary provider.

Observed around class-two-factor-core.php:791-799:

• PHP 8: TypeError from illegal array offset type.
• PHP 7.4: Illegal offset type warnings.

Expected

Normalize persisted primary-provider meta to a bounded scalar provider key before lookup. Malformed state must not fatal admin, profile, CLI, REST, or authentication paths, and authentication should remain fail-closed when persisted state cannot be resolved safely.

Evidence

Found during the aggressive multisite fuzz review of #933:

• 50,001 randomized provider states
• PHP 7.4/WordPress 6.9 and PHP 8.x/current/trunk
• Stable minimized reproduction for object, array, and nested-array values

This is adjacent to but distinct from enabled-provider meta normalization tracked in #941.

Start in class-two-factor-core.php around lines 791-799, then trace how the primary provider is resolved from _two_factor_provider. Exercise the resolution with object, array, and nested-array values and verify that admin, profile, CLI, REST, and authentication paths do not fatal; unresolved persisted state must fail closed.