The app refuses a JMAP server over plain http (loopback aside), yet the desktop issued a code, reported "Signed in on your phone" once it was redeemed, and the phone failed. Linking now stops before the step-up with an explanation.