2FA manual entry uses wrong encoding

Summary

A security researcher discovered that following another change (from report #259415), we used the wrong encoding for the manually entered secret. No sensitive data was exposed and there was no security risk, but users were unable to manually register a new TOTP device for about 12 hours.