Recover account via MFA recovery code

Validates a recovery code. The code is a high-entropy secret that identifies its owner on its own, so no email is required. On success, marks the code used and returns a Firebase custom token. Clients should call signInWithCustomToken and immediately force re-enrollment of TOTP.