Describe the bug

In the profile.php/users.php pages, both the TOTP and Backup Codes providers have an implicit dependency on the core 'wp-api-request' script. wp.apiRequest( is utilized for both to perform actions to generate or reset the methods. This dependency was introduced in be5c0a9#diff-e290bc16d5fdda67b5305bcbc2980a79b7fd1db9aeeb30d44e45510fbd08a751R358 and 4d3cb4f#diff-69add38e41f66d3a63f57e8b385442aeb0199b456bf9692bc5c1778d49d40057R192

Normally, the library is enqueued by WordPress core in user-edit.php as a dependency of 'application-passwords':

if ( wp_is_application_passwords_available_for_user( $user_id ) ) {
	wp_enqueue_script( 'application-passwords' );
}

Unfortunately, if a site has disabled application passwords the 'wp-api-request' is no longer enqueued and provider actions fail with no error handling: Uncaught TypeError: wp.apiRequest is not a function

Steps to Reproduce

1. add_filter( 'wp_is_application_passwords_available', '__return_false' );
2. Attempt to reset TOTP, or generate backup codes
3. Observe error in console.

Screenshots, screen recording, code snippet

Required code snippet to trigger bug:

/**
 * Turn off Application Passwords.
 */
add_filter( 'wp_is_application_passwords_available', '__return_false' );

Environment information

• WordPress 6.1.1, plugin version 0.8.1
• FF/Chrome/any
• Desktop Win 11

Please confirm that you have searched existing issues in this repository.

Yes

Please confirm that you have tested with all plugins deactivated except Two-Factor.

No