Add two-factor authentication option

[anxkhn]

Problem Description

The application only supports password authentication, no two-factor authentication (2FA) is available.

Context

2FA significantly improves account security by requiring a second factor (TOTP) in addition to password.

Steps to Reproduce

1. Log in with just email and password
2. No second factor is required

Expected Behavior

Users should be able to enable 2FA for enhanced security.

Actual Behavior

Only password authentication is available.

Files to Investigate

• `app/models/user.rb` - Add 2FA fields
• `app/controllers/sessions_controller.rb` - Add 2FA verification step
• Add TOTP gem (rotp or devise-two-factor)

Acceptance Criteria

• Add 2FA enrollment flow (QR code setup)
• Add 2FA verification on login
• Add backup codes for recovery
• Add option to disable 2FA
• All existing tests still pass

Suggested Approach

Use rotp gem for TOTP generation:

1. User enables 2FA, generate secret
2. Show QR code for authenticator app
3. Verify setup with code
4. Require 2FA code on subsequent logins

Difficulty: Hard

Estimated time: 3-6 hours
Prerequisites: TOTP, security concepts
Learning outcomes: Two-factor authentication, TOTP implementation