Add two-factor login (TOTP) with recovery codes

Users can set up an authenticator app from their account page; login
then asks for a code after the password, with one-time recovery codes
as a fallback. Sensitive actions (tokens, user changes, 2FA resets)
need a code from the last 5 minutes. totp.require (none/admins/all)
forces setup, and admins can reset a user's 2FA from the UI, the jarl
CLI or jarld on the server. The dashboard and jarl status flag users
missing 2FA and a shared "admin" account still in use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/routes.go

@@ -24,9 +24,15 @@ func (s *Server) routes() {
 	})
 	// Authentication
 	m.HandleFunc("POST "+p+"/auth/login", s.public(s.login))
+	m.HandleFunc("POST "+p+"/auth/login/totp", s.public(s.loginTOTP))
 	m.HandleFunc("POST "+p+"/auth/logout", s.authed(s.logout))
 	m.HandleFunc("GET "+p+"/auth/whoami", s.authed(s.whoami))
 	m.HandleFunc("POST "+p+"/me/password", s.authed(s.changeOwnPassword))
+	m.HandleFunc("GET "+p+"/me/totp", s.authed(s.getOwnTOTP))
+	m.HandleFunc("POST "+p+"/me/totp/setup", s.authed(s.setupOwnTOTP))
+	m.HandleFunc("POST "+p+"/me/totp/enable", s.authed(s.enableOwnTOTP))
+	m.HandleFunc("POST "+p+"/me/totp/disable", s.authed(s.disableOwnTOTP))
+	m.HandleFunc("POST "+p+"/me/totp/recovery-codes", s.authed(s.newRecoveryCodes))
 	m.HandleFunc("GET "+p+"/me/tokens", s.authed(s.listOwnTokens))
 	m.HandleFunc("POST "+p+"/me/tokens", s.authed(s.createOwnToken))
 	m.HandleFunc("DELETE "+p+"/tokens/{id}", s.authed(s.revokeToken))
@@ -40,6 +46,7 @@ func (s *Server) routes() {
 	m.HandleFunc("DELETE "+p+"/users/{id}", s.authed(s.deleteUser))
 	m.HandleFunc("GET "+p+"/users/{id}/tokens", s.authed(s.listUserTokens))
 	m.HandleFunc("POST "+p+"/users/{id}/tokens", s.authed(s.createUserToken))
+	m.HandleFunc("DELETE "+p+"/users/{id}/totp", s.authed(s.resetUserTOTP))
 	// Views
 	m.HandleFunc("GET "+p+"/views", s.authed(s.listViews))
 	m.HandleFunc("POST "+p+"/views", s.authed(s.createView))