Step-up Authentication

Requiring additional authentication when a user attempts a higher-risk action, such as changing email or initiating a large payment. Implemented via OIDC acr_values and amr claims in modern stacks.