Add two-factor login (TOTP) with recovery codes

Users can set up an authenticator app from their account page; login
then asks for a code after the password, with one-time recovery codes
as a fallback. Sensitive actions (tokens, user changes, 2FA resets)
need a code from the last 5 minutes. totp.require (none/admins/all)
forces setup, and admins can reset a user's 2FA from the UI, the jarl
CLI or jarld on the server. The dashboard and jarl status flag users
missing 2FA and a shared "admin" account still in use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/install.md

@@ -230,12 +230,14 @@ tar czf /root/bind-before-jarl-$(date +%F).tgz /etc/bind /var/lib/bind /var/cach
 ## 5. Create the database and the first administrator
 
 ```sh
-sudo -u jarl jarld init --token \
+sudo -u jarl jarld init --token -u adam \
     --nameservers ns1.adbraun.lol. --contact hostmaster@adbraun.lol
 ```
 
-It asks for the administrator's password (user `admin`, change it with
-`-u NAME`). `--token` also prints an API token for the CLI, shown only
+It asks for the administrator's password. Name the account after yourself
+(`-u`, default `admin`): each person should have their own account, with
+their own [two-factor login](permissions.md#two-factor-login), which you
+can turn on under Account once you have logged in. `--token` also prints an API token for the CLI, shown only
 once. `--nameservers` and `--contact` are the defaults for zones you create
 later, and you can change them in the UI or with `jarl settings set`.