fix(api): guard against nil session pointer dereference in user update and recovery codes

[Tyagiquamar]

Problem

When handling tokens where session is nil (e.g. customized access tokens with blank or nil session IDs where maybeLoadUserOrSession does not load a session), requests to PUT /user and recovery codes endpoints crash with a nil pointer dereference panic, resulting in an unhandled HTTP 500 error.

Root Cause

In internal/api/user.go:

• Line 106: user.HasMFAEnabled() && !session.IsAAL2() dereferences session when MFA is enabled and session is nil.
• Line 175: !session.IsRecovery() dereferences session when updating passwords without checking if session is nil.

In internal/api/recovery_codes.go:

• Lines 119 and 204: calls !session.IsAAL2() without ensuring session is non-nil.

Fix

Add nil guards that fail closed consistently with the rest of the API:

• user.HasMFAEnabled() && (session == nil || !session.IsAAL2())
• if session == nil || !session.IsRecovery()
• if session == nil || !session.IsAAL2() in recovery codes generate and regenerate handlers.

Verification

• go vet ./internal/api ran cleanly.
• go test -c ./internal/api compiled successfully.

Fixes #2665