docs: account suspension when recovery code used

[karenjli]

Summary

Documents the temporary 72-hour security hold npm applies when a user logs in with a recovery code. The hold is non-rolling, cannot be lifted early, and expires automatically without any action from the user.

Account behavior during the security hold is clarified across the docs:

• Users can log in, browse and install packages, change their password, and add a new 2FA method.
• Publishing, access-token creation, and security-sensitive account, package, organization, team, billing, and 2FA changes are temporarily blocked.
• Users are directed to contact npm Support immediately if they did not use the recovery code, because their account may have been compromised.

Files updated

• content/getting-started/setting-up-your-npm-user-account/recovering-your-2fa-enabled-account.mdx — added the security-hold behavior before the recovery instructions, removed the unavailable option to disable 2FA during the hold, and updated the recovery-code screenshot.
• content/getting-started/setting-up-your-npm-user-account/configuring-two-factor-authentication.mdx — added a warning that using a recovery code triggers the 72-hour security hold.
• static/getting-started/setting-up-your-npm-user-account/use-a-recovery-code.png — added an updated screenshot of the recovery-code prompt and replaced the previous image.