Request assisted recovery

Use a stored recovery code first. An authorized team can review a request using its established independent verification process. A request does not reset credentials or grant access.