Recovery-only verification

This cannot bypass the passkey chain or directly create a session. Successful verification opens an auditable recovery case.