Admin recovery

Use this only when Microsoft SSO is unavailable or when a GitLab local administrator needs emergency access.