test(mfa): cover disabling 2FA with backup code

spec/requests/api/v1/profile/mfa_controller_spec.rb

@@ -205,6 +205,23 @@ RSpec.describe 'MFA API', type: :request do
           expect(json_response['error']).to include('Invalid')
         end
       end
+
+      context 'with valid password and backup code' do
+        it 'disables 2FA successfully' do
+          backup_code = user.otp_backup_codes.first
+
+          delete '/api/v1/profile/mfa',
+                 params: { password: 'Test@123456', backup_code: backup_code },
+                 headers: user.create_new_auth_token,
+                 as: :json
+
+          expect(response).to have_http_status(:success)
+          user.reload
+          expect(user.otp_required_for_login).to be_falsey
+          expect(user.otp_secret).to be_nil
+          expect(user.otp_backup_codes).to be_blank
+        end
+      end
     end
 
     context 'when 2FA is not enabled' do