Merge branch 'totp'

Both branches added database migration 3: DNSSEC (merged first) keeps 3
and TOTP becomes migration 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/style.css

@@ -242,6 +242,14 @@ button:disabled { opacity: 0.5; cursor: not-allowed; }
 .kv dd { margin: 0; }
 .grants { font-family: var(--mono); font-size: 12px; }
 .copy-box { display: flex; gap: 6px; align-items: center; }
+.login.wide { max-width: 520px; }
+.totp-steps { padding-left: 20px; }
+.totp-steps li { margin-bottom: 12px; }
+.totp-qr { margin: 10px 0; }
+.totp-qr img { display: block; width: 200px; height: 200px; background: #fff; border-radius: var(--radius); }
+.totp-confirm { display: flex; gap: 8px; margin-top: 6px; flex-wrap: wrap; }
+input.totp-code { font-family: var(--mono); font-size: 18px; letter-spacing: 0.15em; max-width: 14em; }
+.recovery-codes { font-family: var(--mono); font-size: 15px; columns: 2; max-width: 360px; }
 .copy-box input { flex: 1; font-family: var(--mono); }
 .ds-record { margin: 12px 0 16px; }
 .ds-record > .copy-box { max-width: 900px; }