Add two-factor login (TOTP) with recovery codes

Users can set up an authenticator app from their account page; login
then asks for a code after the password, with one-time recovery codes
as a fallback. Sensitive actions (tokens, user changes, 2FA resets)
need a code from the last 5 minutes. totp.require (none/admins/all)
forces setup, and admins can reset a user's 2FA from the UI, the jarl
CLI or jarld on the server. The dashboard and jarl status flag users
missing 2FA and a shared "admin" account still in use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/types.go

@@ -68,6 +68,9 @@ type Option struct {
 type User struct {
 	model.User
 	GrantStrings []string `json:"grant_strings"`
+	// TOTPRequired says that totp.require in jarl.yaml makes two-factor
+	// login compulsory for the user.
+	TOTPRequired bool `json:"totp_required,omitempty"`
 }
 
 // Token is an API token. Secret is only set when the token is created.
@@ -86,6 +89,67 @@ type Whoami struct {
 	Permissions []string `json:"permissions"`
 	Admin       bool     `json:"admin"`
 	Version     string   `json:"version"`
+	// TOTP is the user's two-factor login (sessions only).
+	TOTP *TOTPStatus `json:"totp,omitempty"`
+	// TOTPSetupRequired: the user must set up two-factor login before
+	// doing anything else (totp.require).
+	TOTPSetupRequired bool `json:"totp_setup_required,omitempty"`
+}
+
+// LoginChallenge answers a correct password of a user with two-factor
+// login: send a code with the challenge to POST /auth/login/totp.
+type LoginChallenge struct {
+	TOTPRequired bool   `json:"totp_required"`
+	Challenge    string `json:"challenge"`
+}
+
+// LoginTOTP is the second login step.
+type LoginTOTP struct {
+	Challenge string `json:"challenge"`
+	// Code is the current code from the authenticator app, or a recovery
+	// code.
+	Code string `json:"code"`
+}
+
+// TOTPStatus is a user's two-factor login (GET /me/totp).
+type TOTPStatus struct {
+	Enabled           bool       `json:"enabled"`
+	EnabledAt         *time.Time `json:"enabled_at,omitempty"`
+	Required          bool       `json:"required"`
+	RecoveryCodesLeft int        `json:"recovery_codes_left"`
+	// Policy is totp.require: none, admins or all.
+	Policy string `json:"policy"`
+}
+
+// TOTPSetupRequest starts setting up two-factor login.
+type TOTPSetupRequest struct {
+	Password string `json:"password"`
+}
+
+// TOTPSetup is a new secret to put into an authenticator app: QR is the
+// QR code of URI, as an image data: URI.
+type TOTPSetup struct {
+	Secret  string `json:"secret"`
+	URI     string `json:"uri"`
+	QR      string `json:"qr"`
+	Issuer  string `json:"issuer"`
+	Account string `json:"account"`
+}
+
+// TOTPCode confirms a setup.
+type TOTPCode struct {
+	Code string `json:"code"`
+}
+
+// TOTPDisable turns two-factor login off.
+type TOTPDisable struct {
+	Password string `json:"password"`
+	Code     string `json:"code"`
+}
+
+// RecoveryCodes are new recovery codes, shown once.
+type RecoveryCodes struct {
+	Codes []string `json:"recovery_codes"`
 }
 
 // LoginRequest logs in.
@@ -158,6 +222,21 @@ type StatusResponse struct {
 	ExpiringTokens []Token `json:"expiring_tokens"`
 	// Backup is the state of database backups (administrators only).
 	Backup *BackupStatus `json:"backup,omitempty"`
+	// TOTP is about two-factor login across users (administrators only).
+	TOTP *TOTPOverview `json:"totp,omitempty"`
+}
+
+// TOTPOverview is what the dashboard reports about two-factor login.
+type TOTPOverview struct {
+	// Policy is totp.require: none, admins or all.
+	Policy string `json:"policy"`
+	// Missing are enabled users who must use two-factor login and
+	// haven't set it up (they can do nothing else until they do).
+	Missing []string `json:"missing"`
+	// SharedAdmin is set when an enabled administrator called "admin"
+	// (the usual first account) exists next to other enabled
+	// administrators: it is probably shared, and worth disabling.
+	SharedAdmin string `json:"shared_admin,omitempty"`
 }
 
 // TokenExpiresHeader is sent with responses to a token that expires