Authorize account recovery

Only after verifying the player's identity out-of-band. This authorizes a phone-rebind and is fully audited. Relay the recovery code to the player; they complete recovery by verifying their new phone.