Add two-factor login (TOTP) with recovery codes

Users can set up an authenticator app from their account page; login
then asks for a code after the password, with one-time recovery codes
as a fallback. Sensitive actions (tokens, user changes, 2FA resets)
need a code from the last 5 minutes. totp.require (none/admins/all)
forces setup, and admins can reset a user's 2FA from the UI, the jarl
CLI or jarld on the server. The dashboard and jarl status flag users
missing 2FA and a shared "admin" account still in use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/pages/users.js

@@ -16,11 +16,13 @@ export async function render(el) {
     h("div", { class: "panel" }, table([
       { label: "User", render: (u) => h("strong", null, u.username) },
       { label: "Role", render: (u) => [u.admin ? badge("admin", "accent") : null, u.disabled ? badge("disabled", "err") : null, !u.has_password ? badge("tokens only") : null] },
+      { label: "2FA", render: (u) => u.totp_enabled_at ? badge("on", "ok") : u.totp_required ? badge("not set up", "warn") : !u.has_password ? h("span", { class: "muted" }, "–") : h("span", { class: "muted" }, "off") },
       { label: "Permissions", render: (u) => u.admin ? h("span", { class: "muted" }, "everything") : h("div", { class: "grants" }, (u.grant_strings || []).map((g) => h("div", null, g))), tdClass: "small" },
       { label: "Last login", render: (u) => u.last_login_at ? time(u.last_login_at) : h("span", { class: "muted" }, "never") },
       { label: "", render: (u) => h("span", null,
         h("button", { class: "small", onclick: () => tokensDialog(u, grants) }, "Tokens"), " ",
         h("button", { class: "small", onclick: () => userDialog(u, grants) }, "Edit"), " ",
+        u.totp_enabled_at ? [h("button", { class: "small", title: "Turn off their two-factor login (a lost phone without recovery codes)", onclick: () => resetTOTP(u) }, "Reset 2FA"), " "] : null,
         h("button", { class: "small danger", disabled: u.id === state.me.user.id, onclick: () => del(u) }, "Delete")), tdClass: "actions-cell" },
     ], users)),
     grantHelp(grants));
@@ -78,6 +80,15 @@ async function userDialog(u, grants) {
   ], { wide: true, sticky: true });
 }
 
+async function resetTOTP(u) {
+  if (!(await confirmDialog("Reset two-factor login", "Turn off two-factor login for " + u.username + "? Their recovery codes stop working and they are logged out. They log in with the password next time" + (u.totp_required ? " and must set it up again." : ", and can set it up again under Account."), "Reset", "danger"))) return;
+  try {
+    await api("DELETE", "/users/" + u.id + "/totp");
+    toast("Two-factor login of " + u.username + " is off");
+    rerender();
+  } catch (e) { toast(e.message, "err", 8000); }
+}
+
 async function del(u) {
   if (!(await confirmDialog("Delete user", "Delete " + u.username + " and all their API tokens?", "Delete", "danger"))) return;
   try {