Recovery codes

If you lose your phone, a recovery code gets you back in. Each one works once.

What the API can supply: POST /mfa/recovery-codes returns the codes once (shown-once state). After that, GET /mfa/recovery-codes returns only counts — { remaining, total } — never codes, never which ones were used. So every returning state below shows a count sentence and nothing that looks like a code. No masked or struck-through code tiles: the client has no per-code data to draw them from.