Generate a fresh recovery-code set (invalidates the old one); shown once

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.