docs: add an Account Security page

docs/app/overview.mdx

@@ -9,6 +9,8 @@ The Fil One dashboard at [app.fil.one](https://app.fil.one) is the primary inter
 
 Go to [app.fil.one](https://app.fil.one) and sign in. Fil One supports **passkeys** (positioned as the primary method), **Google**, **GitHub**, and **email + password**. If you don't have an account yet, click **Sign up** — no credit card is required to start your 30-day free trial.
 
+To add two-factor authentication, passkeys, or a recovery code, see [Account Security](/security/account-security).
+
 **Verify your email first.** A new account must confirm its email address before the dashboard opens — until you do, every page redirects to a verification screen. Check your inbox for the verification email after signing up.
 
 ## Creating a bucket

docs/security/account-security.mdx

@@ -0,0 +1,63 @@
+---
+title: Account Security
+description: Sign-in methods, two-factor authentication, passkeys, and recovery codes for your Fil One account.
+---
+
+This page covers securing the account you sign in with. For authenticating **API requests**, which is a separate mechanism, see [Authentication](/security/authentication) and [API Keys](/security/api-keys).
+
+## Signing in
+
+Fil One supports four sign-in methods:
+
+- **Passkeys**, the primary method
+- **Google**
+- **GitHub**
+- **Email with password**
+
+A new account must verify its email address before the dashboard opens. Until you do, every page redirects to a verification screen.
+
+## Two-factor authentication
+
+Two-factor authentication is opt-in per user and managed from **Settings**, under **Security**. Three factor types are supported:
+
+| Factor | Shown in the dashboard as | What it is |
+|--------|---------------------------|------------|
+| Authenticator app | **Authenticator app (OTP)** | A time-based one-time code from an app such as 1Password, Authy, or Google Authenticator |
+| Security key | **Security key** | A roaming WebAuthn authenticator, for example a YubiKey |
+| Device biometrics | **Device biometrics** | A platform WebAuthn authenticator: Face ID, Touch ID, or Windows Hello |
+
+**SMS and email codes are deliberately not offered.** Both are vulnerable to SIM-swap and mailbox-compromise attacks, so Fil One only supports factors bound to a device or an app.
+
+You can enrol more than one factor and remove individual ones from Settings.
+
+## Passkeys
+
+Passkeys are listed separately from two-factor methods in Settings, under **Passkeys**. If you have none enrolled, the dashboard prompts you to add one on your next sign-in.
+
+You can hold up to **20 passkeys** on one account, which is enough to cover several devices without having to retire an old one to add a new one.
+
+## Recovery codes
+
+A recovery code is a single-use code for signing in if you lose access to your authenticator. Generate or replace one from **Settings** → **Security** → **Recovery code** → **Regenerate**.
+
+Generating a new code invalidates the previous one, so store the new value somewhere durable before you close the dialog.
+
+## Changes to security settings require re-authentication
+
+Four actions are gated behind a fresh two-factor check, even inside an already signed-in session:
+
+- Removing a two-factor method
+- Removing all two-factor methods
+- Removing a passkey
+- Regenerating a recovery code
+
+If your current session was not established with a strong factor, the dashboard sends you back through sign-in to step up before the action proceeds. This means someone who gains access to an open session still cannot quietly strip the account's protections.
+
+## Changing your password
+
+Change your account password from **Settings** → **Security** → **Password** → **Change**. This sends a password-reset email to your registered address.
+
+## Related
+
+- [Authentication](/security/authentication): signing API requests with SigV4
+- [API Keys](/security/api-keys): creating and scoping keys for programmatic access

docs/security/authentication.mdx

@@ -9,6 +9,10 @@ import TabItem from '@theme/TabItem';
 
 All API requests to Fil One must be authenticated using AWS Signature Version 4 (SigV4). This is the same authentication method used by AWS S3, so any S3-compatible SDK or tool handles it automatically.
 
+:::note Looking for account sign-in?
+This page is about signing **API requests**. For the account you log into the dashboard with, including two-factor authentication, passkeys, and recovery codes, see [Account Security](/security/account-security).
+:::
+
 :::note Keys and endpoints are region-specific
 Every access key belongs to a **single region**, chosen when you create it, and it only authenticates requests to that region's endpoint. Examples below use `eu-west-1`, the default region — for `us-east-1`, use `https://us-east-1.s3.fil.one` and region `us-east-1`. If you store data in both regions you need a key for each.
 :::

sidebars.js

@@ -28,6 +28,7 @@ const sidebars = {
       type: "category",
       label: "Security",
       items: [
+        "security/account-security",
         "security/authentication",
         "security/api-keys",
         "security/encryption",

static/llms-full.txt

@@ -1045,6 +1045,61 @@ whether Object Lock meets a specific obligation as part of your own compliance
 process.
 
 
+---
+
+# Account Security
+
+Source: https://docs.fil.one/security/account-security
+
+Covers securing the account you sign in with. API request authentication is a
+separate mechanism (see Authentication / API Keys).
+
+## Signing in
+
+Four methods: passkeys (the primary method), Google, GitHub, and email with
+password. A new account must verify its email address before the dashboard
+opens; until then every page redirects to a verification screen.
+
+## Two-factor authentication
+
+Opt-in per user, managed from Settings > Security. Three factor types:
+
+| Factor | Dashboard label | What it is |
+|--------|-----------------|------------|
+| Authenticator app | Authenticator app (OTP) | Time-based one-time code from an app (1Password, Authy, Google Authenticator) |
+| Security key | Security key | Roaming WebAuthn authenticator, e.g. a YubiKey |
+| Device biometrics | Device biometrics | Platform WebAuthn authenticator: Face ID, Touch ID, Windows Hello |
+
+SMS and email codes are DELIBERATELY NOT OFFERED (SIM-swap and
+mailbox-compromise risk). Only device- or app-bound factors are supported. More
+than one factor can be enrolled, and individual ones removed.
+
+## Passkeys
+
+Listed separately from two-factor methods, under Settings > Passkeys. With none
+enrolled, the dashboard prompts to add one on next sign-in. Limit is 20 passkeys
+per account.
+
+## Recovery codes
+
+A single-use code for signing in after losing access to an authenticator.
+Generate or replace from Settings > Security > Recovery code > Regenerate.
+Generating a new code invalidates the previous one.
+
+## Step-up re-authentication
+
+Four actions require a fresh two-factor check even within a signed-in session:
+removing a two-factor method, removing all two-factor methods, removing a
+passkey, and regenerating a recovery code. A session not established with a
+strong factor is sent back through sign-in first, so someone with access to an
+open session cannot quietly strip the account's protections.
+
+## Changing your password
+
+Settings > Security > Password > Change sends a password-reset email to the
+registered address.
+
+
 ---
 
 # Authentication

static/llms.txt

@@ -91,6 +91,15 @@ Critical integration notes for developers:
 
 ## Security
 
+- [Account Security](https://docs.fil.one/security/account-security): securing
+  the account you sign in with (distinct from API request auth). Sign-in via
+  passkeys (primary), Google, GitHub, or email with password; email
+  verification is mandatory before the dashboard opens. Opt-in two-factor with
+  three factor types: authenticator app (OTP), security key (WebAuthn roaming),
+  device biometrics (WebAuthn platform). SMS and email codes are deliberately
+  NOT offered. Up to 20 passkeys per account. Single-use recovery codes.
+  Removing a factor or passkey, removing all factors, and regenerating a
+  recovery code all require a fresh two-factor check (step-up)
 - [Authentication](https://docs.fil.one/security/authentication): SigV4 auth
   setup for AWS CLI, Python (boto3), JavaScript (AWS SDK v3), and Go; credential
   best practices including environment variable usage