One-time recovery codes

Recovery code verification is backed by Argon2id hashes in the agent. Each successful sign-in burns one code permanently.