snapshot: preserve account security and profile UI cleanup

backend/workflows/totp.py

@@ -5,6 +5,7 @@ import hashlib
 import hmac
 import secrets
 import struct
+import string
 from urllib.parse import quote
 
 
@@ -47,3 +48,19 @@ def build_otpauth_uri(secret: str, *, account_name: str, issuer: str) -> str:
     label = quote(f'{issuer}:{account_name}')
     issuer_q = quote(issuer)
     return f'otpauth://totp/{label}?secret={secret}&issuer={issuer_q}&algorithm=SHA1&digits=6&period=30'
+
+
+def normalize_recovery_code(value: str | None) -> str:
+    raw = (value or '').strip().upper().replace(' ', '')
+    return raw
+
+
+def generate_recovery_codes(count: int = 8) -> list[str]:
+    alphabet = string.ascii_uppercase + string.digits
+    codes = []
+    for _ in range(count):
+        parts = []
+        for _part in range(2):
+            parts.append(''.join(secrets.choice(alphabet) for _ in range(5)))
+        codes.append('-'.join(parts))
+    return codes