[Feature] 请求增加以一次性令牌作为可选两步验证的功能

### 功能描述 / Description

支持以Microsoft Authenticator等app作为两步验证器，开启用户名和密码输入后进行一次性验证码验证的功能

### 请求动机 / Motivation

防止登录前端用户名和密码被扫描和爆破

### 其他 / Miscellaneous

_No response_

### 贡献 / Contribution

- [ ] 我乐意为此贡献 PR！ / I am interested in contributing a PR for this!

The issue requests optional one-time-token verification after username and password authentication, using apps such as Microsoft Authenticator. No files, tests, or authentication entry points are identified; first locate the login flow and its existing tests, then confirm the desired enrollment, verification, and recovery behavior before implementation.

Written by the indexing model from the issue text.