auth(2fa): add one-time recovery codes with regenerate/status APIs

app/auth/schemas.py

@@ -15,6 +15,7 @@ class LoginRequest(BaseModel):
     email: EmailStr
     password: str = Field(min_length=8, max_length=128)
     otp_code: str | None = Field(default=None, min_length=6, max_length=8)
+    recovery_code: str | None = Field(default=None, min_length=6, max_length=32)
 
 
 class RefreshTokenRequest(BaseModel):
@@ -86,6 +87,14 @@ class TwoFactorCodeRequest(BaseModel):
     code: str = Field(min_length=6, max_length=8)
 
 
+class TwoFactorRecoveryCodesRead(BaseModel):
+    codes: list[str]
+
+
+class TwoFactorRecoveryStatusRead(BaseModel):
+    remaining_codes: int
+
+
 class EmailStatusResponse(BaseModel):
     email: EmailStr
     registered: bool