Get the caller's TOTP enrollment status

Reports whether the caller has an authenticator enrolled and whether it is confirmed, so the dashboard can render the correct control and decide whether to offer TOTP as a step-up factor. Also reports the recovery-code counts for the set backing that enrollment (never the codes themselves — those are returned once, at /v1/totp/enroll/confirm). All-zero counts with a null generated_at mean the account holds no codes; the whole recovery_codes object is omitted when the counts could not be read, which clients must treat as unknown rather than zero. login_mfa reports whether login actually enforces a second factor: confirmed=true with login_mfa=false means MFA is switched off for the account, so the authenticator is enrolled but will never be required at login, and the client should say so rather than claim the account is protected. It too is omitted when unreadable, which is unknown and not false.