Implement TOTP two-factor with trusted-device and recovery codes (per docs/MFA_ROADMAP)

[nanaf6203-bit]

Context

docs/MFA_ROADMAP.md details TOTP rollout; schema has UserPreferences.twoFactorEnabled and secret fields (migration 20260324084550); auth.service already handles CAPTCHA gating.

Problem

The roadmap exists but none of it is shipped. A real-estate transaction platform without 2FA leaves admin/agent sessions and password resets as single-factor - a primary account-takeover vector given the financial nature of listings/transactions in this codebase.

Proposed approach

Deliver TOTP (e.g. otplib/speakeasy): enroll (QR via qrcode), verify enablement, challenge during login when enabled, session trust marker (skip re-challenge), recovery codes, and admin ability to force-disable on request. Refuse high-risk ops without fresh 2FA.

Acceptance criteria

• Enroll/challenge/recover works in e2e; never disables itself into a locked account.

[beulah7717108-eng]

@beulah7717108-eng has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

Hi Maintainer
i have critically review the acceptance criteria
please kindly

ℹ️ Repo Maintainers: To accept this application, review their application or assign @beulah7717108-eng to this issue.

[drips-wave]

Congratulations, @beulah7717108-eng! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on September 30, 2026.

🧑‍💻 @beulah7717108-eng: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊