feat(auth): add TOTP 2FA setup and login verification

- add user twofa fields and migration

- add 2FA setup/enable/disable endpoints

- enforce OTP on login when 2FA enabled

- add web login OTP field and settings UI

alembic/versions/0018_user_twofa.py

@@ -0,0 +1,28 @@
+"""add user twofa fields
+
+Revision ID: 0018_user_twofa
+Revises: 0017_user_contacts
+Create Date: 2026-03-08 23:35:00.000000
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = "0018_user_twofa"
+down_revision: Union[str, Sequence[str], None] = "0017_user_contacts"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column("users", sa.Column("twofa_enabled", sa.Boolean(), nullable=False, server_default=sa.text("false")))
+    op.add_column("users", sa.Column("twofa_secret", sa.String(length=64), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column("users", "twofa_secret")
+    op.drop_column("users", "twofa_enabled")
+