PR #4425 was authored before #4429 widened NewUserHandler with the step-up TOTP and user services, and merged without a rebase, breaking typecheck on main.