Fallback access

Use a one-time recovery code

Recovery opens only enough access to add a passkey. Completing recovery signs out other browser sessions but does not silently delete existing passkeys.