Merge branch 'totp'

Both branches added database migration 3: DNSSEC (merged first) keeps 3
and TOTP becomes migration 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -43,6 +43,28 @@ All notable changes to Jarl are documented here. The format follows
   writes a zone file whose serial isn't higher (after restoring an older
   database, say), so named loads it (it refuses otherwise for a signed
   zone) and secondaries pick it up.
+- Two-factor login to the web UI with an authenticator app (TOTP: SHA-1,
+  6 digits, 30 s, as every app supports). Users turn it on under Account
+  (password, QR code, a code to confirm) and get 10 one-time recovery
+  codes. Logging in then asks for a code (or a recovery code) after the
+  password; each code works once. In a session with two-factor login,
+  creating or rotating API tokens, changing users and resetting someone's
+  two-factor login need a code from the last 5 minutes: the web UI asks
+  for one, API clients send `X-Jarl-TOTP`. API tokens and the local socket
+  are not affected.
+- `totp.require` in jarl.yaml (`none`, `admins`, `all`) makes two-factor
+  login compulsory; such a user who hasn't set it up can only set it up
+  after logging in. `totp.issuer` names the server in authenticator apps
+  (default `Jarl <hostname>`).
+- Resetting a user's two-factor login (lost phone): Users → Reset 2FA,
+  `jarl user totp reset NAME`, or on the server
+  `jarld user totp reset NAME` (also with jarld stopped).
+- The dashboard and `jarl status` list users who must use two-factor login
+  but haven't set it up, and suggest disabling the first `admin` account
+  when it is still active next to personal administrator accounts.
+  `jarl user list`/`show` and the Users page show who uses it.
+- API: `POST /auth/login/totp`, `/me/totp` (`setup`, `enable`, `disable`,
+  `recovery-codes`), `DELETE /users/{id}/totp`; database migration 4.
 - `scripts/testenv.sh`: turns a fresh Debian/Ubuntu machine into a test bed.
   It installs BIND and the build tools (Go from go.dev), writes a hand-made
   style configuration with internal and external views, a split-horizon
@@ -74,6 +96,8 @@ All notable changes to Jarl are documented here. The format follows
 - Publishing a release candidate failed: `scripts/gitea-release.sh`
   rejected its `.deb`s, whose names carry the Debian version
   (`0.2.0~rc.1`) instead of `0.2.0-rc.1`.
+- `jarld init -u` and the install guide recommend naming the first
+  administrator after yourself (one account per person).
 - `jarld import` no longer warns that a zone with `allow-update { none; }`
   uses dynamic updates (validation already allowed it).
 - docs/cli.md gives the CLI configuration file's location on macOS