- Add recovery email for self‑service password reset and account recovery
- Enable MFA device registration for all sign‑in methods, including Google, Apple, GitHub, and Amazon logins
- Allow users to switch from third‑party login to email/password while retaining MFA protection