chore: verifyRecoveryCode - Persist the used_at write immediately

So a consumed recovery code cannot be reused on a subsequent request.

Author: matiasperrone-exo

app/Strategies/MFA/AbstractMFAChallengeStrategy.php

@@ -51,6 +51,7 @@ public function verifyRecoveryCode(User $user, string $code): void
         foreach ($this->recovery_code_repository->getUnusedByUser($user) as $recoveryCode) {
             if (Hash::check($code, $recoveryCode->getCodeHash())) {
                 $recoveryCode->markUsed();
+                $this->recovery_code_repository->add($recoveryCode, true);
                 return;
             }
         }

tests/Unit/MFA/AbstractMFAChallengeStrategyTest.php

@@ -90,6 +90,7 @@ public function testVerifyRecoveryCode_withMatchingCode_marksAsUsed(): void
 
         $repo = \Mockery::mock(IUserRecoveryCodeRepository::class);
         $repo->shouldReceive('getUnusedByUser')->with($user)->andReturn([$recoveryCode]);
+        $repo->shouldReceive('add')->with($recoveryCode, true)->once();
 
         $strategy = new class($repo) extends AbstractMFAChallengeStrategy {
             public function issueChallenge(User $user, ?Client $client, bool $remember): array { return []; }