Generate MFA recovery codes

Generates 10 one-time recovery codes for the authenticated user. Any previously issued codes are invalidated. Plaintext codes are returned exactly once; the server stores only bcrypt hashes.