- add user twofa fields and migration
- add 2FA setup/enable/disable endpoints
- enforce OTP on login when 2FA enabled
- add web login OTP field and settings UI
- store refresh session metadata in redis (ip/user-agent/created_at)
- add auth APIs: list sessions, revoke one, revoke all
- add web privacy UI for active sessions
- add chat_updated realtime event and dynamic chat subscriptions
- auto-join invite links in web app
- implement Telegram-like settings panel (general/notifications/privacy)
- add browser notification preferences and keyboard send mode
- improve chat list with last message preview/time and online badge
- rework chat members UI with context actions and role crowns