Add MFA support with TOTP and recovery codes #1725

Goal

Provide a complete multi-factor authentication flow for local accounts.

Acceptance criteria

• Users can enroll and remove TOTP.
• Login supports the second-factor challenge.
• Recovery codes can be generated, displayed once, revoked, and consumed once.
• Administrative policy can require MFA for selected users or roles.
• Integration tests cover enrollment, successful login, invalid codes, recovery codes, and lockout.