@spec generate(AshAuthentication.Strategy.RecoveryCode.t(), map(), keyword()) ::
  {:ok, Ash.Resource.record()} | {:error, any()}

Generate new recovery codes for a user.

Deletes any existing recovery codes and generates new ones. Returns the user with plaintext codes in __metadata__.recovery_codes.

@spec generate_code(pos_integer(), String.t()) :: String.t()

Generate a single random recovery code using :crypto.strong_rand_bytes/1.

@spec generate_codes_list(pos_integer(), pos_integer(), String.t()) :: [String.t()]

Generate a list of random recovery codes using a CSPRNG.

@spec verify(AshAuthentication.Strategy.RecoveryCode.t(), map(), keyword()) ::
  {:ok, Ash.Resource.record()} | {:error, any()}

Verify a recovery code for a user.

Takes a user and a recovery code, verifies against stored hashed codes, deletes the code on success, and returns the authenticated user.