Merge branch 'totp'

Both branches added database migration 3: DNSSEC (merged first) keeps 3
and TOTP becomes migration 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -365,7 +365,9 @@ jarl user create alice --role dns-editor               # asks for a password
 jarl user create ci --no-password --grant "records:write zones=lab.adbraun.lol"
 jarl user update alice --admin
 jarl user update alice --password                      # set a new password
-jarl user update bob --disabled                        # logs bob out, blocks his tokens
+jarl user update bob --disabled                        # logs bob out, blocks bob's tokens
+jarl user update admin --rename adam                   # rename (e.g. the first account, to your own name)
+jarl user totp reset alice                             # turn off alice's two-factor login (lost phone)
 jarl user delete bob -y
 
 jarl token list [--user alice | --all] [--revoked]
@@ -377,6 +379,11 @@ jarl token rotate laptop --save                        # new secret, same token
 jarl token rotate --current --save --grace 10m         # the token this CLI uses
 jarl token revoke 7
 
+# 'jarl user list' and 'jarl user show' include two-factor login (2FA: on,
+# off, or MISSING when totp.require applies and it isn't set up). Users set
+# it up themselves in the web UI (Account); the CLI's tokens never need a
+# code (permissions.md#two-factor-login).
+
 jarl audit [--user alice] [--action auth.login_failed] [--outcome failure] [--since 2026-10-01] [--limit 100]
 jarl search 192.168.1.20
 jarl status          # named, adoption, drift, open changesets, backups, expiring tokens, problems