Completes enrollment by validating a code from the authenticator paired at /v1/totp/enroll. Once confirmed, the authenticator can satisfy step-up actions via /v1/challenges/verify with factor "totp". Returns a fresh set of single-use recovery codes, which REPLACES any previous set and is shown here exactly once — only hashes are stored, so the client must display them to the user immediately. Each code can satisfy login's second factor once, via /v1/auth with factor "recovery_code"; using one removes the authenticator. Too many wrong codes returns 429 with Retry-After; that throttle is scoped to enrollment and does not affect login.