v2.13.0 — 2FA recovery codes (A83)

A83: one-time recovery codes for two-factor auth. When you enable 2FA you now get 8 single-use recovery codes, shown once — keep them somewhere safe and you can sign in even if you lose your authenticator. At the login challenge, choose "Use a recovery code"; each code works exactly once. Settings shows how many codes remain and lets you regenerate them (current password + a valid authenticator code required). Codes are stored encrypted at rest.