0.2.38: optional two-factor authentication (authenticator-app TOTP)

Per-user opt-in 2FA: enroll from the Two-factor option next to Change
password (QR + confirm code + 8 one-time recovery codes), login becomes
two-step for enrolled users, disable requires the account password.
Escape hatch for lost phones: reset-2fa CLI + Reset Two-Factor StartOS
action. Second-factor guesses share the login rate limiter; the pending
login window expires after 5 minutes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/ten31portal/models.py

@@ -79,6 +79,12 @@ class User(SQLModel, table=True):
     # When this investor last loaded their documents list — docs newer than this get a "New"
     # badge in the portal. Null until their first visit (nothing badged for brand-new logins).
     docs_seen_at: datetime | None = Field(default=None)
+    # Two-factor auth (optional, per-user opt-in). The secret is set at setup time but only
+    # counts once totp_enabled is True (enrollment is confirmed with a first valid code).
+    totp_secret: str | None = Field(default=None)
+    totp_enabled: bool = Field(default=False)
+    # JSON list of sha256 hex digests of unused one-time recovery codes.
+    totp_recovery_codes: str | None = Field(default=None)
     created_at: datetime = Field(default_factory=datetime.utcnow)