Recovery: bundle import needs a passkey step-up like export #403

full_recovery_bundle_import_inner (api/auth_gateway.rs:1721-2010) checks the Home/System launch token, a proof-bound session and an active passkey principal, but no step-up and no admin check, while export consumes a step-up (:1567). Someone holding a session and a valid bundle can bind replacement principal-root and wallet material, including reassign_to_current_principal.

Done means: import requires a fresh step-up; guests cannot use reassign_to_current_principal; tests.

Source: external audit of develop 55dcb79 (rev 3) verified independently by OMP and grook on 16 Oct. Related: #88, #178.