feat: self-service account recovery with a delay and notifications #399

Why

Users without codes still need a path that does not depend on an admin, but one an attacker cannot use quietly.

What

• Start recovery through a verified email or phone
• A configurable waiting period before recovery completes
• Notify every other channel and active session, with a one-click cancel
• Revoke sessions and require new passkey enrollment on completion
• Off by default, configurable per deployment

Done when

Recovery works without an admin, cannot complete silently, and is fully audited.