Bug 2059948 - Do not offer recovery codes to Duo users

[loganrosen]

Commit 9e23f77 landed the production fix that prevents Duo users from generating BMO recovery codes. This follow-up fills the remaining gaps:

• Update the two-factor authentication guide, which still said Duo users were offered the recovery-code generator.
• Add Selenium coverage confirming the recovery-code control is absent for Duo users.
• Verify a forged recovery request is rejected even if it spoofs TOTP as the submitted provider.

Test:

• qa/t/2_test_login_duo.t (35 tests)

https://bugzilla.mozilla.org/show_bug.cgi?id=2059948

[Copilot]

Pull request overview

Restricts BMO recovery-code generation to TOTP accounts and rejects forged requests for unsupported MFA providers.

Changes:

• Adds an explicit recovery-code capability enabled only for TOTP.
• Hides Duo recovery controls and adds server-side enforcement.
• Adds Duo regression coverage and updates documentation.

Show a summary per file

File	Description
userprefs.cgi	Validates recovery requests against the account’s provider.
Bugzilla/MFA.pm	Defines and enforces the provider capability.
Bugzilla/MFA/TOTP.pm	Enables recovery codes for TOTP.
template/en/default/account/prefs/mfa.html.tmpl	Conditionally displays recovery controls.
template/en/default/global/user-error.html.tmpl	Adds the unsupported-provider error.
qa/t/2_test_login_duo.t	Tests hidden controls and forged requests.
docs/en/rst/using/two-factor-authentication.rst	Documents recovery codes as TOTP-only.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 7/7 changed files
• Comments generated: 0
• Review effort level: Balanced

[dklawren]

9e23f77 as a Duo security fix that also had changes inside that remove recovery codes for Duo. Please take a look and if this PR is a duplicate then please close, if not see if anything was missed and update this PR to fill in the gaps. Thanks!

[loganrosen]

Thanks! I compared this against 9e23f77 and rebased the PR onto current master. The production changes were duplicates, so I removed them and narrowed this PR to the two gaps left behind: correcting the stale user guide and adding Selenium coverage for the hidden Duo recovery control and a forged recovery request that spoofs TOTP. The focused Duo test passes all 35 tests.