auth(2fa): add one-time recovery codes with regenerate/status APIs

alembic/versions/0025_user_twofa_recovery_codes.py

@@ -0,0 +1,26 @@
+"""add recovery codes storage for 2fa
+
+Revision ID: 0025_user_twofa_recovery_codes
+Revises: 0024_chat_bans
+Create Date: 2026-03-09 16:55:00.000000
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = "0025_user_twofa_recovery_codes"
+down_revision: Union[str, Sequence[str], None] = "0024_chat_bans"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column("users", sa.Column("twofa_recovery_codes_hashes", sa.String(length=4096), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column("users", "twofa_recovery_codes_hashes")
+