Enter your recovery code (saved in Keychain when this was first set up) and choose a new password. This resets your password only — you'll still need your authenticator app to actually log back in afterward, so a stolen recovery code alone can't get in. See DEPLOYMENT.md.