feat(auth): add TOTP 2FA setup and login verification

- add user twofa fields and migration

- add 2FA setup/enable/disable endpoints

- enforce OTP on login when 2FA enabled

- add web login OTP field and settings UI

web/src/store/authStore.ts

@@ -8,7 +8,7 @@ interface AuthState {
   me: AuthUser | null;
   loading: boolean;
   setTokens: (accessToken: string, refreshToken: string) => void;
-  login: (email: string, password: string) => Promise<void>;
+  login: (email: string, password: string, otpCode?: string) => Promise<void>;
   loadMe: () => Promise<void>;
   refresh: () => Promise<void>;
   logout: () => void;
@@ -27,10 +27,10 @@ export const useAuthStore = create<AuthState>((set, get) => ({
     localStorage.setItem(REFRESH_KEY, refreshToken);
     set({ accessToken, refreshToken });
   },
-  login: async (email, password) => {
+  login: async (email, password, otpCode) => {
     set({ loading: true });
     try {
-      const data = await loginRequest(email, password);
+      const data = await loginRequest(email, password, otpCode);
       get().setTokens(data.access_token, data.refresh_token);
       await get().loadMe();
     } finally {