Labels: Backend, Security, Auth
Complexity: High (200 points) 🔐

Description

Add an extra layer of security by implementing Two-Factor Authentication using Time-based One-Time Passwords (TOTP).

Requirements / Context

• Use otplib or speakeasy.
• Flow: Enable 2FA -> Generate Secret -> Verify -> Require on Login.

Acceptance Criteria

• POST /auth/2fa/generate and POST /auth/2fa/enable.
• POST /auth/2fa/verify for login.
• QR code generation for authenticator apps.