Open a disclosure reauthentication window with a TOTP code.

The possession-factor half of the reveal ceremony (#58, permission-model ADR § The reveal guard). It is DISCLOSURE reauthentication, not account step-up: it opens a sliding window over one environment and changes nothing about the account.

The environment is RESOLVED AND AUTHORIZED under read(E) before its reauthentication policy is looked at. An environment the caller cannot reach answers exactly as a nonexistent one does — the uniform 401 this route gives every other refusal — so the policy-shaped 409 below is never an oracle for which environment ids exist or which are protected.

TOTP cannot bind its challenge to an enumerated unit, so it cannot honour a per-disclosure gate. Where the environment's effective window is 0 — which every protected environment is capped at — this route REFUSES with 409, naming the passkey ceremony as the remedy, and /auth/webauthn/reauth/* is the only path that opens a window there.

The reauth rotates the acting session; a browser session's rotated token is delivered on the __Host-hikyo cookie.