fix: make recovery code active on add (#11734)

# Which Problems Are Solved

- Recovery codes added via `GenerateRecoveryCodes` were never listed as
active authentication methods by `ListAuthenticationMethodTypes`. The
`user_auth_method` projection reducer (`reduceInitAuthMethod`) set the
state to `MFAStateNotReady`, expecting a subsequent verification event
to transition it to `MFAStateReady`. Unlike TOTP, U2F, and Passwordless
— which all have distinct verification events — recovery codes have no
such event, so they were permanently stuck in `NotReady`.

# How the Problems Are Solved

- Introduced a dedicated `reduceAddRecoveryCodes` reducer for
`HumanRecoveryCodesAddedEvent` that sets `MFAStateReady` immediately,
since recovery codes are usable as soon as they are generated.
- Uses `NewUpsertStatement` (instead of `NewCreateStatement`) so that
regenerating recovery codes for the same user updates the existing row
rather than failing on a duplicate key conflict.
- Removed the `HumanRecoveryCodesAddedEvent` case from
`reduceInitAuthMethod`.

# Additional Changes

- Added `UserAuthMethodTypeRecoveryCode` mapping in `authMethodTypeToPb`
unit test.
- Added integration tests for `ListAuthenticationMethodTypes` covering
both the "recovery codes present" and "recovery codes removed" cases.

# Additional Context

* https://github.com/zitadel/zitadel/issues/11317

---------

Co-authored-by: Marco A. <[email protected]>
Co-authored-by: Cursor <[email protected]>

internal/query/projection/user_auth_method_test.go

@@ -540,7 +540,7 @@ func TestUserAuthMethodProjection_reduces(t *testing.T) {
 					}`),
 					), eventstore.GenericEventMapper[user.HumanRecoveryCodesAddedEvent]),
 			},
-			reduce: (&userAuthMethodProjection{}).reduceInitAuthMethod,
+			reduce: (&userAuthMethodProjection{}).reduceAddRecoveryCodes,
 			want: wantReduce{
 				aggregateType: user.AggregateType,
 				sequence:      15,
@@ -556,7 +556,7 @@ func TestUserAuthMethodProjection_reduces(t *testing.T) {
 								"instance-id",
 								"agg-id",
 								uint64(15),
-								domain.MFAStateNotReady,
+								domain.MFAStateReady,
 								domain.UserAuthMethodTypeRecoveryCode,
 								"",
 							},