0.2.38: optional two-factor authentication (authenticator-app TOTP)

Per-user opt-in 2FA: enroll from the Two-factor option next to Change
password (QR + confirm code + 8 one-time recovery codes), login becomes
two-step for enrolled users, disable requires the account password.
Escape hatch for lost phones: reset-2fa CLI + Reset Two-Factor StartOS
action. Second-factor guesses share the login rate limiter; the pending
login window expires after 5 minutes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/pyproject.toml

@@ -15,6 +15,8 @@ dependencies = [
     "starlette-session==0.4.3",
     "openpyxl==3.1.5",
     "msoffcrypto-tool==6.0.0",
+    "pyotp==2.9.0",
+    "qrcode==8.2",
 ]
 
 [project.optional-dependencies]