Add two-factor authentication support

[stranske]

Feature Request

Is your feature request related to a problem?
Security best practices recommend 2FA for all user accounts.

Describe the solution you'd like

• Support TOTP (Google Authenticator, Authy)
• Optional SMS fallback
• Recovery codes for account recovery
• Admin ability to enforce 2FA for all users

Additional context
This is required for SOC 2 compliance.

---

Test Case: Should get ONLY enhancement label.