Add opt-in TOTP 2FA for local accounts

New card in Настройки → Аккаунт: scan a QR code (otplib + qrcode), confirm
with a live code, get 8 one-time recovery codes shown once. Only offered
for authSource="local" — LDAP accounts already have their own MFA story at
the directory level and are turned away with a clear message if they somehow
hit the setup endpoint directly.

Login flow: a 2FA account's password check now creates a short-lived
"login challenge" (separate table from `sessions`, 5-minute TTL, capped at
6 verify attempts) instead of a real session, and the login page swaps to a
second screen asking for a code — TOTP or a recovery code, either works.
The LDAP branch of the login route is untouched; it returns before ever
reaching the 2FA check.

totpSecret is encrypted at rest via the existing lib/crypto/credentials.ts
helper (same one already used for mailbox/LDAP bind passwords) rather than
adding a second encryption scheme. Recovery codes are hashed, not stored
plaintext, and each is single-use (marked usedAt, not deleted).

Verified against the real deployment end-to-end with Playwright against a
throwaway test account (created via the real admin-users API, fully
deleted after): setup → confirm → recovery-code issuance → second login
correctly prompted for a code → wrong code rejected → correct code and a
recovery code both worked → a reused recovery code was correctly rejected
→ disable (password-gated) → subsequent login went straight through again.
Also added unit tests for the TOTP/recovery-code helpers.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GteWhnWKTmnXcsd5jx6H7u

src/app/api/auth/totp/setup/route.ts

@@ -0,0 +1,35 @@
+export const runtime = "nodejs";
+
+import { NextResponse } from "next/server";
+import { eq } from "drizzle-orm";
+import { requireSession } from "@/lib/auth/require";
+import { db } from "@/lib/db/client";
+import { users } from "@/lib/db/schema";
+import { generateTotpSecret, encryptTotpSecret, buildTotpQrCode } from "@/lib/auth/totp";
+
+/**
+ * Starts (or restarts) 2FA setup — generates a fresh secret and stores it
+ * encrypted, but leaves totpEnabled false until /confirm proves the user
+ * actually scanned it (see users.totpEnabled comment in schema.ts). Safe to
+ * call again if the user abandons setup partway — it just overwrites the
+ * unconfirmed secret with a new one.
+ */
+export async function POST() {
+  const { session, response } = await requireSession();
+  if (!session) return response;
+
+  const user = await db.query.users.findFirst({ where: eq(users.id, session.user.id) });
+  if (!user) return NextResponse.json({ error: "User not found" }, { status: 404 });
+  if (user.authSource !== "local") {
+    return NextResponse.json(
+      { error: "2FA доступна только для локальных аккаунтов — вход через LDAP защищён на уровне домена" },
+      { status: 400 },
+    );
+  }
+
+  const secret = generateTotpSecret();
+  await db.update(users).set({ totpSecret: encryptTotpSecret(secret), totpEnabled: false }).where(eq(users.id, user.id));
+
+  const qrDataUrl = await buildTotpQrCode(secret, user.email);
+  return NextResponse.json({ secret, qrDataUrl });
+}