This page bypasses RBAC and is for Super Admin recovery only.
All attempts are logged at rbac.emergency WARNING level.
Run from the production server shell (requires SSH + MySQL root):
./yiic rbac/reset-super-admin --email=YOUR@EMAIL
Generates a 16-char temporary password, clears TOTP, invalidates all sessions, issues 10 fresh recovery codes. Logs as a CRITICAL audit event.