Two-step: adding a method asks for one you already have

With a passkey or authenticator set up, adding another (or removing one, or new recovery codes) now wants a check with an existing method (passkey, authenticator or recovery code) in the last Mfa.ChangeLifetime (10 minutes). Before, the check that keeps Admin open (12 hours) was enough, so a session left open could add its own passkey. A confirmed password still sets up the first method only. The page asks for the check before starting (verifiedForChanges). Docs, changelog, test.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com