Fresh passkey or authenticator-code check. Replaces an open confirm instead of stacking a second modal.