Account recovery

Use a recovery code

A valid one-time code revokes existing sessions and creates a short replacement-passkey invitation.

Responses do not reveal whether an account exists.