R3 two-factor sign-in: TOTP with recovery codes, asked for only after a correct password

Completion program R3 (docs/ROADMAP.md, 2026-10-17).

- Services/TwoFactor.cs: TOTP (RFC 6238, 30 s, 6 digits, SHA-1, one step of slack, Otp.NET 1.4.1) and ten recovery
  codes (SHA-256 kept, pulled when used). RootUser.Totp holds the secret, the last step taken (moved only by a
  conditional update, so a code works once even for two sign-ins at the same moment) and the codes' hashes.
- /clientapi/user/totp/setup (the password) answers the secret, its otpauth:// URI and a QR code as an SVG data URI
  (QRCoder 1.8.0); /totp/enable takes the app's first code, shows the recovery codes once and ends every other session
  (this device gets a new one); /totp/disable takes the password and a code. GET /clientapi/user/account says whether
  it is on and how many recovery codes are left.
- Sign-in (/clientapi/user/login, the invitation login, /oauth/login) asks for LoginForm.OneTimeCode with a 428, and
  only once the password was right; the OAuth page has the field. Recovery by email leaves two-factor on.
- PrivaPub admin reset-totp <root>: the way back for a login that lost its authenticator and its codes.
- scenarios/accounts.sh checks it all, with codes computed in Python; the OAuth page with its antiforgery token.

Verified: dotnet build PrivaPub.sln -c Release; the pasture (gts, mailpit): accounts 45/45.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Models/User/RootUser.cs

@@ -22,6 +22,7 @@ namespace PrivaPub.Models.User
 		public DateTime? CredentialsChangedAt { get; set; }//when RootSessions last ended every session
 		public string SessionStamp { get; set; }//carried by every /clientapi token; a new one ends the tokens issued before
 		public List<EndedSession> EndedSessions { get; set; } = new();//sessions signed out one by one, until their tokens expire
+		public RootTotp Totp { get; set; }//two-factor sign-in, when the login set it up (Services/TwoFactor.cs)
 
 		/// <summary>An administrator is a moderator too (IsAdminPolicy asks for both); otherwise a plain user.</summary>
 		public void SetAdmin(bool admin)
@@ -35,6 +36,18 @@ namespace PrivaPub.Models.User
 		}
 	}
 
+	// TOTP (RFC 6238: 30 s, 6 digits, SHA-1, as every authenticator app reads it). PendingSecret waits for its first code;
+	// LastStep refuses a code used before; a recovery code is kept as its SHA-256 and works once.
+	public class RootTotp
+	{
+		public string Secret { get; set; }//base32
+		public DateTime? EnabledAt { get; set; }
+		public long LastStep { get; set; }
+		public List<string> RecoveryCodeHashes { get; set; } = new();
+		public string PendingSecret { get; set; }
+		public DateTime? PendingSince { get; set; }
+	}
+
 	// a session that signed out: its tokens carry Sid, and are refused until Until, when they would have expired anyway
 	public class EndedSession
 	{