If I lose a password, what do I almost always have to do?
1. Email account recovery link.
2. Input auth code sent from text message or authenticator app. [Optional.]
3. Make new random password I'm going to forget or lose.
Why bother with this? If email is the reset mechanism why does the industry care so much about getting passwords from users?
1. Email sign-in link.
2. Input auth code. [Optional]
Everything other part of this whole chain gets simpler. No more password strength checking code. No multiple auth paths. No issues with anything. Just a single email with at most two links, one for browser sign in, one for app sign in.
If you really, really, really need to you can add one or two QR codes so these hypothetical people that don't have email on their phone can sign into the app.