OpenPasskey Recovery API

Minimal KV for credentialId → xyHex. No secrets handled.