Use this route to start the visible recovery path for the same password-backed account boundary used by login. `/recover` always records a recovery request reference first. When the same username plus stored account email matches a verified account, ForAgent can also send the next one-time `/recover/:token` email without telling this browser whether that delivery happened. If you are still signed in anywhere, use `/profile` first to change the password or send the next recovery email instead of opening recovery.