2FA enrollment UI (TOTP, recovery codes)

[ogyamada]

The DB schema and Fortify backend support for 2FA is already in place —
users.two_factor_secret, users.two_factor_recovery_codes,
users.two_factor_confirmed_at columns exist from the
2026_05_24_235929_add_two_factor_columns_to_users_table migration. The
Fortify feature is enabled in config/fortify.php.

What's missing is the front-end. Users have no way to turn 2FA on.

Done means

• New page at apps/web/app/settings/security/page.tsx.
• "Enable two-factor auth" button → calls Fortify's
  POST /auth/user/two-factor-authentication → shows the QR (SVG returned
  by Fortify) + secret string.
• After scanning, user enters the 6-digit code →
  POST /auth/user/confirmed-two-factor-authentication with code.
• Recovery codes view (GET /auth/user/two-factor-recovery-codes) with
  a "download as .txt" and "regenerate" action.
• "Disable 2FA" path requires password re-confirm
  (POST /auth/user/confirm-password).
• Login flow handles the 2FA challenge response when Fortify returns
  two_factor: true from /auth/login.
• Link added to TopNav.tsx user-menu dropdown → "Account settings".
• Works on mobile (single column, the QR isn't tiny).

Notes

• Use the typed wrappers in apps/web/lib/api.ts — add a twoFactor
  namespace alongside auth.
• Don't reinvent the password-confirm modal — Fortify's challenge flow
  exists, just consume it.