slice 2 UI: 2FA enrollment (enable -> secret/QR/backup codes -> confirm)

Orchestrator (me) SPA work: auth client +2FA/OAuth methods, 2FA strings, AuthSection
enrollment flow. Primary-Rule lint stays green. Slice 2 (auth-2fa-and-social-oauth)
COMPLETE: 2FA + OAuth backend (ornith modules + me integration) + 2FA enrollment UI.

app/src/lib/strings.ts

@@ -24,6 +24,15 @@ export const UI_STRINGS = {
   loginButton: "Sign in",
   logoutButton: "Sign out",
   signupPrompt: "Create an account to track symbols and keep your research in one place.",
+  enable2faButton: "Enable two-factor",
+  twoFactorSecretLabel: "Two-factor secret (base32)",
+  twoFactorQrLabel: "Scan this in an authenticator app, or enter the secret manually.",
+  backupCodesLabel: "Backup codes — store these somewhere safe.",
+  confirm2faButton: "Confirm with a code",
+  twoFactorCodePlaceholder: "6-digit code",
+  twoFactorEnabled: "Two-factor is now enabled. Login will ask for a code.",
+  oauthGithub: "Continue with GitHub",
+  oauthGoogle: "Continue with Google",
 } as const;
 
 export const UI_STRING_LIST: string[] = Object.values(UI_STRINGS);

app/src/lib/trpc.ts

@@ -76,8 +76,11 @@ export const api = {
   market: { snapshot: (symbol: string) => trpcQuery<Snapshot>("market.snapshot", { symbol }) },
   auth: {
     signup: (email: string, password: string) => trpcMutate<{ userId: string }>("auth.signup", { email, password }),
-    login: (email: string, password: string) => trpcMutate<{ userId: string }>("auth.login", { email, password }),
+    login: (email: string, password: string, totp?: string) => trpcMutate<{ userId: string }>("auth.login", { email, password, ...(totp ? { totp } : {}) }),
     logout: () => trpcMutate<{ ok: boolean }>("auth.logout", {}),
     me: () => trpcQuery<AuthUser | null>("auth.me"),
+    enable2fa: () => trpcMutate<{ totpSecret: string; qrUrl: string; backupCodes: string[] }>("auth.enable2fa", {}),
+    confirm2fa: (totp: string) => trpcMutate<{ ok: boolean }>("auth.confirm2fa", { totp }),
+    oauthStart: (provider: "github" | "google", redirectUri: string) => trpcMutate<{ redirectUrl: string; state: string }>("auth.oauthStart", { provider, redirectUri }),
   },
 };