OpenPasskey Recovery API
Minimal KV for credentialId → xyHex. No secrets handled.