Backup Codes: When used, the user should be forced to their 2FA settings

[dd32]

When a user logs in with a backup code / recovery code, it should be assumed that this is a case where they've lost their 2FA details.

We should override the redirection location to be their 2FA settings.

[dd32]

Thinking this through; there's twothree different cases related to backup codes, each with a slightly different interstitial / redirect case

1. Logged in with a backup code - Do you need to setup a new 2FA provider? or do you just not have your keys with you right now?
2. Logged in normally; but now has a few (3?) backup code remaining - Do you need to download/store new backup codes?
3. Logged in normally; but doesn't have any verified backup codes - Nag, Hey did you download/store those? Go generate new ones plz

2&3 are probably one and the same really, and should be a priority to reduce nuisance account lock-out issues before #9
1 is likely far less urgent, and could potentially be irrelevant depending on how #9 is resolved.