Add KEY-WP-0040: recovery preview defect and OTP prompt help link from attended MFA run

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87

workplans/KEY-WP-0040-mfa-attended-run-findings.md

@@ -0,0 +1,56 @@
+---
+id: KEY-WP-0040
+type: workplan
+title: "Fix findings from the first attended MFA run (factor recovery preview, OTP prompt help)"
+domain: infotech
+repo: key-cape
+status: ready
+owner: claude-code
+topic_slug: netkingdom
+created: "2026-10-11"
+updated: "2026-10-11"
+flavor: implementation
+depends_on: []
+---
+
+From the attended run of 2026-10-11 (user-engine `docs/evidence/2026-10-11-mfa-attended-u05-u08.md`).
+U05–U07 passed. U08 is blocked by T01.
+
+## Recovery preview rejects valid input (F6)
+
+```task
+id: KEY-WP-0040-T01
+status: todo
+priority: high
+```
+
+Operator `platform-root` (holds platform-operator, fresh AAL2) previewed login `tegwick`,
+reference `U08-2026-10-11` at `/platform/factor-recovery`. Every attempt returned `invalid_request`
+("Enter a valid login and support reference."). Both inputs match `[A-Za-z0-9_.@:/-]{1,150}`.
+The `factor-recovery` container in `mfa/privacyidea` logged nothing.
+
+Candidate causes in `scripts/recovery_service.py` / `scripts/factor_recovery.py`:
+- the actor `sub` (KeyCape `user.ID`) failing `_recover`'s character rule;
+- a privacyIDEA serial failing it;
+- the request body differing from what is validated, e.g. form encoding through the portal.
+
+Done when:
+- the failing check is identified and fixed with a regression test;
+- the sidecar logs the failing check (field name and error code, never values);
+- a preview for `tegwick` lists the active TOTP (serial suffix …E1D) without applying anything.
+
+Then hand back to user-engine, which re-runs U08 (USER-WP-0028-T03). The fix and roll-out
+of the sidecar are blue lane under the build-mode change rule.
+
+## Link the OTP prompt to lost-authenticator help (F3)
+
+```task
+id: KEY-WP-0040-T02
+status: todo
+priority: medium
+```
+
+The OTP input offers no way out for a user whose code is rejected or whose device is lost. Add
+"Code rejected or lost your authenticator?" linking to
+`https://users.coulomb.social/security` (the lost-authenticator section). The same link serves users
+who have no factor yet (the dead end noted in `mfa-attended-run.md`).