Removing a phone credential

Step-up: a password-holding user supplies currentPassword; a password-less user an otpCode (from POST /v1/me/mfa/otp/request). TWO separate guards, both returning 409. (1) last_credential — refused if the phone is the user's ONLY credential (e.g. a phone-first account from scenario 3); an email counts only if it is VERIFIED, since login refuses an unverified one. (2) PRIMARY-CHANNEL — refused, and ENFORCED rather than merely advised, while login_mode = 'phone'. That case is a HARD lockout the last-credential guard cannot catch: it asks “is any credential left?” (yes — email + password), not “can the login this account will actually be asked to complete still be completed?”. With the number gone, every new-device challenge would still be planned on the phone channel and could neither be delivered nor satisfied. Switch the channel first (scenario 31), then remove. Unlinking also DROPS any phone_otp MFA method bound to the number — leaving it enrolled would advertise a second factor whose channel no longer existed, moving the same lockout one hop later; ensure another factor remains or re-enrol (scenario 25).