Add two-factor login (TOTP) with recovery codes

Users can set up an authenticator app from their account page; login
then asks for a code after the password, with one-time recovery codes
as a fallback. Sensitive actions (tokens, user changes, 2FA resets)
need a code from the last 5 minutes. totp.require (none/admins/all)
forces setup, and admins can reset a user's 2FA from the UI, the jarl
CLI or jarld on the server. The dashboard and jarl status flag users
missing 2FA and a shared "admin" account still in use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -334,7 +334,9 @@ jarl user create alice --role dns-editor               # asks for a password
 jarl user create ci --no-password --grant "records:write zones=lab.adbraun.lol"
 jarl user update alice --admin
 jarl user update alice --password                      # set a new password
-jarl user update bob --disabled                        # logs bob out, blocks his tokens
+jarl user update bob --disabled                        # logs bob out, blocks bob's tokens
+jarl user update admin --rename adam                   # rename (e.g. the first account, to your own name)
+jarl user totp reset alice                             # turn off alice's two-factor login (lost phone)
 jarl user delete bob -y
 
 jarl token list [--user alice | --all] [--revoked]
@@ -346,6 +348,11 @@ jarl token rotate laptop --save                        # new secret, same token
 jarl token rotate --current --save --grace 10m         # the token this CLI uses
 jarl token revoke 7
 
+# 'jarl user list' and 'jarl user show' include two-factor login (2FA: on,
+# off, or MISSING when totp.require applies and it isn't set up). Users set
+# it up themselves in the web UI (Account); the CLI's tokens never need a
+# code (permissions.md#two-factor-login).
+
 jarl audit [--user alice] [--action auth.login_failed] [--outcome failure] [--since 2026-10-01] [--limit 100]
 jarl search 192.168.1.20
 jarl status          # named, adoption, drift, open changesets, backups, expiring tokens, problems