Password recovery

Ask Admin to verify your identity and issue a one-time recovery token. Tokens expire after 15 minutes. Existing MFA remains required.