v2.13.1 — recovery codes refresh on re-enrollment (A83)

Erratum to A83. Resetting / re-enrolling two-factor now issues a fresh set of recovery codes and invalidates the previous ones — so codes from a replaced (possibly compromised) setup can no longer sign in.