Update deployment workflow

[yihao03]

Since end of 2025, npm doesn't allow 2FA through TOTP anymore, however, the current publishing workflow still requires OTP. For now, recovery codes could be used as a workaround.

see this issue for more details