Merge branch 'totp'

Both branches added database migration 3: DNSSEC (merged first) keeps 3
and TOTP becomes migration 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -43,6 +43,10 @@ error: www.adbraun.lol has a CNAME, so it can't have any other records (found A)
   using it).
   Passwords use argon2id, sessions have CSRF protection, logins are rate
   limited.
+* **Two-factor login** with any authenticator app (TOTP), with recovery
+  codes; optional per user, or required for administrators or everyone
+  (`totp.require`). With it on, creating API tokens and changing users
+  asks for a fresh code, so a stolen password can't be turned into a token.
 * **Audit log** of every login, change and token, with user, token, IP and
   outcome.
 * **Daily backups** of the database and the DNSSEC keys by a systemd timer,
@@ -107,7 +111,7 @@ in `/etc/jarl/jarl.yaml` to reach it from your management network.
 | [docs/configuration.md](docs/configuration.md) | `/etc/jarl/jarl.yaml` reference |
 | [docs/cli.md](docs/cli.md) | The `jarl` command line client |
 | [docs/api.md](docs/api.md) | REST API reference |
-| [docs/permissions.md](docs/permissions.md) | Users, tokens, grants and roles |
+| [docs/permissions.md](docs/permissions.md) | Users, tokens, grants and roles, two-factor login |
 | [docs/views.md](docs/views.md) | Split DNS: adding views to a server that has none |
 | [docs/dnssec.md](docs/dnssec.md) | DNSSEC signing, going public with your own name servers, Porkbun |
 | [docs/acme.md](docs/acme.md) | Let's Encrypt DNS-01 with certbot, acme.sh, lego and Traefik |
@@ -144,7 +148,7 @@ these pages:
 * **Changes**: pending edits with the diff, named-checkconf output and
   problems, applied as one changeset. History lists applied changesets with
   their diffs and a revert button.
-* **Audit, Users, Account** (password, API tokens) and **Search**.
+* **Audit, Users, Account** (password, two-factor login, API tokens) and **Search**.
 
 By default, edits are collected as pending changes. Pending rows are shown
 inline (green = new, yellow = changed, struck out = deleted) until you