No passkey is registered yet. Paste the one-shot bootstrap token (SSH into the server and run cat /root/vix/control_panel/data/bootstrap_token.txt).
Use your phone's Face ID / Touch ID to sign in.
Restart cycles the IB Gateway in place (triggers 2FA push). Force-restart does a full down + recreate — heavier, use when graceful restart didn't fix things.