Two-factor authentication fixes

Recovery codes are accepted with or without the hyphen. The first code after setting up 2FA is accepted, and reopening the setup dialog keeps the same QR code. A code entered at the end of its 30-second window still counts. An expired sign-in step now sends you back to sign in instead of reporting a valid code as invalid.