Offline account recovery

This path consumes the current recovery code, resets the password, revokes active administrator, OAuth and API sessions, and issues a new one-time recovery code.