Currently we display recovery codes when setting up a TOTP method, but not when setting up a WebAuthn method. Once T232336: Separate recovery codes into a separate 2FA module is done, recovery codes will be independent of TOTP, and should be generated and displayed to the user when they set up their first method, regardless of whether it's TOTP or WebAuthn. This requires (conditionally) adding recovery code display to the WebAuthn setup flow, and conditionally removing it from the TOTP setup flow if the user already has recovery codes.

• Display recovery codes when the user sets up their first 2FA method, whether it's TOTP or WebAuthn
• Display existing recovery codes if the user already has them