Add optional TOTP and security-key MFA alongside passkeys

Requested as a PR stacked on PAR-382. Enable voluntary TOTP and WebAuthn security-key enrollment, enforce a configured second factor after password sign-in, preserve user-verified passkey sign-in, and expose clear account-security management. Verify unenrolled, TOTP, security-key, and passkey journeys with a disposable account. Keep existing users and sessions intact.