Add two-factor login (TOTP) with recovery codes

Users can set up an authenticator app from their account page; login
then asks for a code after the password, with one-time recovery codes
as a fallback. Sensitive actions (tokens, user changes, 2FA resets)
need a code from the last 5 minutes. totp.require (none/admins/all)
forces setup, and admins can reset a user's 2FA from the UI, the jarl
CLI or jarld on the server. The dashboard and jarl status flag users
missing 2FA and a shared "admin" account still in use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/style.css

@@ -242,6 +242,14 @@ button:disabled { opacity: 0.5; cursor: not-allowed; }
 .kv dd { margin: 0; }
 .grants { font-family: var(--mono); font-size: 12px; }
 .copy-box { display: flex; gap: 6px; align-items: center; }
+.login.wide { max-width: 520px; }
+.totp-steps { padding-left: 20px; }
+.totp-steps li { margin-bottom: 12px; }
+.totp-qr { margin: 10px 0; }
+.totp-qr img { display: block; width: 200px; height: 200px; background: #fff; border-radius: var(--radius); }
+.totp-confirm { display: flex; gap: 8px; margin-top: 6px; flex-wrap: wrap; }
+input.totp-code { font-family: var(--mono); font-size: 18px; letter-spacing: 0.15em; max-width: 14em; }
+.recovery-codes { font-family: var(--mono); font-size: 15px; columns: 2; max-width: 360px; }
 .copy-box input { flex: 1; font-family: var(--mono); }
 .sortable-row { display: flex; align-items: center; gap: 8px; }
 @media (max-width: 700px) {