Deleting all WebAuthn devices doesn't reset the recovery codes

If there is only one WebAuthn device registered, deleting it should destroy the recovery codes. On a subsequent authenticator registration, new recovery codes should be displayed.

When there is only one WebAuthn device registered, these two actions should have the same results:

Step to reproduce

1. Delete all registered authenticators
2. Enable the following feature flag: Feature.enable(:webauthn_without_totp)
3. Register a WebAuthn device
4. User is redirected to see the recovery codes
5. Delete the registered device
6. Register a new authenticator (TOTP or WebAuthn)
7. The user is not redirected to see the recovery codes, hence I assume the previous recovery codes are still valid.¹

Screen_Recording_2023-03-02_at_21.50.11

1. Confirmed, see video ↩