Add two-factor login (TOTP) with recovery codes

Users can set up an authenticator app from their account page; login
then asks for a code after the password, with one-time recovery codes
as a fallback. Sensitive actions (tokens, user changes, 2FA resets)
need a code from the last 5 minutes. totp.require (none/admins/all)
forces setup, and admins can reset a user's 2FA from the UI, the jarl
CLI or jarld on the server. The dashboard and jarl status flag users
missing 2FA and a shared "admin" account still in use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/model/changeset.go

@@ -70,8 +70,17 @@ type User struct {
 	CreatedAt    time.Time  `json:"created_at"`
 	UpdatedAt    time.Time  `json:"updated_at"`
 	LastLoginAt  *time.Time `json:"last_login_at,omitempty"`
+	// TOTPEnabledAt is when the user turned on two-factor login (nil:
+	// off). The secrets never leave the server.
+	TOTPEnabledAt *time.Time `json:"totp_enabled_at,omitempty"`
+	TOTPSecret    string     `json:"-"`
+	TOTPPending   string     `json:"-"`
+	TOTPLastStep  int64      `json:"-"`
 }
 
+// HasTOTP reports whether the user logs in with a TOTP code.
+func (u *User) HasTOTP() bool { return u.TOTPSecret != "" }
+
 // Token is an API key. The secret is shown once at creation and only its
 // hash is stored.
 type Token struct {
@@ -125,6 +134,9 @@ type Session struct {
 	LastSeenAt time.Time `json:"last_seen_at"`
 	IP         string    `json:"ip"`
 	UserAgent  string    `json:"user_agent"`
+	// TOTPAt is when the session last proved a TOTP code (at login or
+	// since); nil for a session without two-factor login.
+	TOTPAt *time.Time `json:"totp_at,omitempty"`
 }
 
 // AuditEvent records an action.