fix: normalize recovery code server-side before hash check

Hash::check() compared the raw submitted code against the dash-less
uppercase hash, so the "strip separators + uppercase" contract was
only enforced by the login.js client. Any other consumer submitting
a code exactly as displayed (XXXX-XXXX) would fail verification on
this lockout-critical path. Apply the same normalization in
AbstractMFAChallengeStrategy::verifyRecoveryCode() before Hash::check.

Author: romanetar

app/Strategies/MFA/AbstractMFAChallengeStrategy.php

@@ -48,6 +48,11 @@ public function clearPendingState(): void
 
     public function verifyRecoveryCode(User $user, string $code): void
     {
+        // Recovery codes are hashed without the "-" separator; it is added only
+        // for on-screen readability (XXXX-XXXX). Normalize here so a code typed
+        // or pasted exactly as displayed still matches the stored hash.
+        $code = strtoupper(preg_replace('/[^A-Za-z0-9]/', '', $code));
+
         foreach ($this->recovery_code_repository->getUnusedByUser($user) as $recoveryCode) {
             if (Hash::check($code, $recoveryCode->getCodeHash())) {
                 // Concurrency: acquire a PESSIMISTIC_WRITE row lock and re-hydrate