slice 2a COMPLETE: TOTP 2FA (enable2fa/confirm2fa/login-2fa + protectedProcedure)

totp.ts + backup-codes.ts produced by ornith (remote model, reviewed+approved);
router/context/schema integration by orchestrator (delicate edit-existing — ornith
timed out on a dispatch of that size in-session). 58/58 backend tests green.
2FA flow: enable2fa -> confirm2fa -> login now requires a valid TOTP.

app/server/src/db/schema.sql

@@ -18,6 +18,7 @@ CREATE TABLE IF NOT EXISTS users (
   complexity       TEXT NOT NULL DEFAULT 'beginner',   -- beginner|intermediate|advanced
   risk_tolerance   TEXT NOT NULL DEFAULT 'moderate',
   convexity_posture TEXT NOT NULL DEFAULT 'off',        -- off|covered_income|cash_secured_entry|insurance_sleeve|leaps_conviction
+  backup_codes_hashed TEXT,                        -- JSON array of scrypt-hashed backup codes (slice 2)
   created_at       TEXT NOT NULL
 );