Locked out?
Both ways back in need only FTP or your host's file manager.
Forgot your password?
Use the link on the login page. It emails you a link that works for an hour, when the site can send mail.
If it can't, upload a file named storage/reset-password whose only line is the new password, 12 characters or more. The next visit to the login page sets it and deletes the file.
Lost the phone with your two-step login?
Upload an empty file named storage/disable-2fa. Your next login switches two-step login off and deletes the file.
Too many wrong passwords?
After five wrong passwords in a quarter of an hour, logging in is paused for a while. A browser that has logged in here before isn't stopped by someone else's guesses, so nobody can keep you out just by knowing your address.
Recovery codes
When you switch on two-step login you get ten recovery codes. Each works once, in place of the code from your phone. Keep them somewhere other than the phone.