I'm just about done. There's still:

1. big foot gun warning when user is about to remove their last authentication method like having them type

I want to unlink my last auth method, and if I logout, even accidentally, without linking another auth method, I will never be able to access my account again

2. a few backend hacks to get this to work need to be fixed
3. general polishing