feat(auth): add TOTP 2FA setup and login verification

- add user twofa fields and migration

- add 2FA setup/enable/disable endpoints

- enforce OTP on login when 2FA enabled

- add web login OTP field and settings UI

web/src/api/auth.ts

@@ -5,8 +5,8 @@ export async function registerRequest(email: string, name: string, username: str
   await http.post("/auth/register", { email, name, username, password });
 }
 
-export async function loginRequest(email: string, password: string): Promise<TokenPair> {
-  const { data } = await http.post<TokenPair>("/auth/login", { email, password });
+export async function loginRequest(email: string, password: string, otpCode?: string): Promise<TokenPair> {
+  const { data } = await http.post<TokenPair>("/auth/login", { email, password, otp_code: otpCode || undefined });
   return data;
 }
 
@@ -32,3 +32,21 @@ export async function revokeSession(jti: string): Promise<void> {
 export async function revokeAllSessions(): Promise<void> {
   await http.delete("/auth/sessions");
 }
+
+export interface TwoFactorSetupResponse {
+  secret: string;
+  otpauth_url: string;
+}
+
+export async function setupTwoFactor(): Promise<TwoFactorSetupResponse> {
+  const { data } = await http.post<TwoFactorSetupResponse>("/auth/2fa/setup");
+  return data;
+}
+
+export async function enableTwoFactor(code: string): Promise<void> {
+  await http.post("/auth/2fa/enable", { code });
+}
+
+export async function disableTwoFactor(code: string): Promise<void> {
+  await http.post("/auth/2fa/disable", { code });
+}