Recovery invalidates all active sessions while preserving two-factor protection.
We’ll send an expiring reset link if the account exists.