[BUG] 2FA security issues

**Describe the bug**
There are several issues with the 2fa system:

* 2fa code can be brute-forced, because you won't get kicked when typing the wrong code.
* When adding 2fa, it does not ask you for confirmation code, so if you type the command to add 2fa and exit the game, your account will be lost.

The issue names no files, tests, or entry points. Start by locating the Java 2FA and authentication flows, then reproduce wrong-code attempts and enabling 2FA without a confirmation code. Done means both reported security issues are addressed and regression coverage verifies the resulting behavior.

Written by the indexing model from the issue text.