Add two-factor login (TOTP) with recovery codes

Users can set up an authenticator app from their account page; login
then asks for a code after the password, with one-time recovery codes
as a fallback. Sensitive actions (tokens, user changes, 2FA resets)
need a code from the last 5 minutes. totp.require (none/admins/all)
forces setup, and admins can reset a user's 2FA from the UI, the jarl
CLI or jarld on the server. The dashboard and jarl status flag users
missing 2FA and a shared "admin" account still in use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/store.go

@@ -238,6 +238,23 @@ CREATE TABLE deployed_files (
 ALTER TABLE tokens ADD COLUMN rotated_at TEXT;
 ALTER TABLE tokens ADD COLUMN prev_secret_hash TEXT NOT NULL DEFAULT '';
 ALTER TABLE tokens ADD COLUMN prev_expires_at TEXT;
+`,
+	// 3: two-factor login with TOTP. totp_pending holds a secret being set
+	// up until a code confirms it; totp_last_step is the newest time step
+	// used, so a code works only once. sessions.totp_at is when the
+	// session last proved a code (for actions that ask for a recent one).
+	`
+ALTER TABLE users ADD COLUMN totp_secret TEXT NOT NULL DEFAULT '';
+ALTER TABLE users ADD COLUMN totp_pending TEXT NOT NULL DEFAULT '';
+ALTER TABLE users ADD COLUMN totp_enabled_at TEXT;
+ALTER TABLE users ADD COLUMN totp_last_step INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE sessions ADD COLUMN totp_at TEXT;
+CREATE TABLE recovery_codes (
+	user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+	code_hash TEXT NOT NULL,
+	used_at TEXT,
+	PRIMARY KEY (user_id, code_hash)
+);
 `,
 }