Comment by XCSme

I just asked the model to implement 2FA and it did address all the points you've mentioned.

EDIT: Support was not the case, because the app is self-hosted, but the docs should indeed provide instructions for recovery if both authenticator and recovery codes are lost.