0.2.38: optional two-factor authentication (authenticator-app TOTP)

Per-user opt-in 2FA: enroll from the Two-factor option next to Change
password (QR + confirm code + 8 one-time recovery codes), login becomes
two-step for enrolled users, disable requires the account password.
Escape hatch for lost phones: reset-2fa CLI + Reset Two-Factor StartOS
action. Second-factor guesses share the login rate limiter; the pending
login window expires after 5 minutes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/ten31portal/schemas.py

@@ -26,9 +26,37 @@ class UserResponse(BaseModel):
     is_active: bool
     is_service_admin: bool = False
     primary_account_id: int | None = None  # set when this account logs in under another
+    totp_enabled: bool = False
     created_at: datetime
 
 
+class LoginPending2FA(BaseModel):
+    """Password accepted, waiting on the second factor before the session is signed in."""
+    requires_2fa: bool = True
+
+
+class TotpVerifyRequest(BaseModel):
+    code: str  # 6-digit authenticator code, or a one-time recovery code
+
+
+class TotpSetupResponse(BaseModel):
+    secret: str
+    otpauth_uri: str
+    qr_svg: str
+
+
+class TotpConfirmRequest(BaseModel):
+    code: str
+
+
+class TotpConfirmResponse(BaseModel):
+    recovery_codes: list[str]  # shown exactly once
+
+
+class TotpDisableRequest(BaseModel):
+    password: str
+
+
 # --- User administration ---
 
 class UserCreate(BaseModel):