Add Optional Two-Factor Authentication (2FA) for User Accounts

To improve account security, we should add optional two-factor authentication (2FA) for users. This will allow users to enable 2FA via TOTP (e.g., Google Authenticator, Authy) in their account settings, but not require it for all users.

Requirements:

• Users can enable or disable 2FA from their account settings.
• When enabled, users must scan a QR code with an authenticator app to set up 2FA.
• On login, if 2FA is enabled, users must enter a valid TOTP code after password authentication.
• Users should be able to generate and view backup codes for account recovery.
• Store TOTP secrets and backup codes securely.
• UI/UX for enabling/disabling 2FA, entering codes, and managing backup codes.

Technical Notes:

• Use the rotp gem for TOTP generation/validation.
• Use the rqrcode gem to generate QR codes.
• Add otp_secret and otp_backup_codes columns to the users table.
• Update authentication flow to require TOTP code if 2FA is enabled.

Acceptance Criteria:

• Users can opt in/out of 2FA.
• 2FA is enforced only for users who have enabled it.
• Backup codes are available and can be regenerated.
• All sensitive data is handled securely.

Start by locating the existing account settings, authentication flow, and users table described in the issue. Review how rotp and rqrcode would fit those entry points, then verify that opt-in 2FA, TOTP login, secure secrets, and backup-code recovery meet the listed acceptance criteria.