Merge branch 'totp'

Both branches added database migration 3: DNSSEC (merged first) keeps 3
and TOTP becomes migration 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/present.go

@@ -1,6 +1,8 @@
 package server
 
 import (
+	"context"
+
 	"jarl/internal/api"
 	"jarl/internal/auth"
 	"jarl/internal/catalog"
@@ -132,8 +134,20 @@ func presentToken(t *model.Token) api.Token {
 	return out
 }
 
-func (s *Server) whoamiOf(p *auth.Principal, se *model.Session) api.Whoami {
-	out := api.Whoami{User: presentUser(p.User), Method: p.Method, Permissions: p.Summary(), Admin: p.IsAdmin(), Version: s.cfg.Version}
+// userOut is presentUser with what depends on the server's settings.
+func (s *Server) userOut(u *model.User) api.User {
+	out := presentUser(u)
+	out.TOTPRequired = s.totpRequired(u)
+	return out
+}
+
+func (s *Server) whoamiOf(ctx context.Context, p *auth.Principal, se *model.Session) api.Whoami {
+	out := api.Whoami{User: s.userOut(p.User), Method: p.Method, Permissions: p.Summary(), Admin: p.IsAdmin(), Version: s.cfg.Version}
+	if p.Method == "session" {
+		st := s.totpStatus(ctx, p.User)
+		out.TOTP = &st
+		out.TOTPSetupRequired = s.setupOnly(p)
+	}
 	if p.Token != nil {
 		t := presentToken(p.Token)
 		out.Token = &t