A single-use magic link is emailed to the authorized operator. Two-factor (TOTP) is required after the link. Sessions last 30 days (sliding).