feat: tfa validate endpoint, user self request, cleanup

[golanglemonade]

• Adds a /v1/2fa/validate endpoint to use to validate an OTP code request - We additionally have the otp_code as an input to the Login endpoint; I've removed this for now as it wasn't actually ever checked. If we want to include that as part of the login handler we can pull out most of this logic and reuse it across both handlers.

This validate endoint will take in either an otp_code or a recovery_code. If the otp code is provided it will validate it against the secret. If the recovery code is provided, it will validate it against the database values and remove the value once used.

• Removes recovery codes from all request except an update tfa request
• adds the QR code generation to the tfa update request
• removes tfa secret from TFA responses
• removes tags from tfa setting schema
• adds a self query to only pull data about the authorized user

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
33.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud