Contoso is rolling out passwordless authentication for a new group of frontline workers who have no existing credentials. IT wants each worker to complete a self-service bootstrap on their first day: sign in once with a time-limited passcode issued by the helpdesk, then immediately register a FIDO2 security key. The passcode must be usable only once and expire within 4 hours. Which authentication method should you configure in the Authentication methods policy to enable this onboarding flow?