BSM Magic Login v1.0.35

- Added account-owner passkey management to WordPress profiles.
- Require recent password or same-session email verification before passkey creation/removal.
- Block administrator enrollment of another user’s passkeys.
- Administrators can update users’ mobile numbers; every number change resets SMS verification and revokes pending SMS codes.
- Removed the user-editable SMS verified checkbox.
- Added email notification for phone changes.
- Protected emergency revocation with POST, nonce, administrator password and confirmation.

Testing: PHP lint, JS syntax and ZIP integrity. Live WordPress, SMS and WebAuthn end-to-end tests NOT performed.
