feat: Add two-factor authentication via TOTP

Adds TOTP setup with QR code, login challenge, recovery codes and
trusted devices that let a browser skip the second factor for 30
days. Admins can reset another user's second factor by confirming
with their own password.

server/package.json

@@ -72,6 +72,7 @@
     "mime-types": "^3.0.2",
     "moment": "^2.30.1",
     "nodemailer": "^9.0.3",
+    "otplib": "^12.0.1",
     "patch-package": "^8.0.1",
     "pg": "^8.20.0",
     "read": "^5.0.1",
@@ -82,6 +83,7 @@
     "sails-postgresql": "^5.0.1",
     "serve-static": "^2.2.1",
     "sharp": "^0.35.3",
+    "ua-parser-js": "^2.0.10",
     "undici": "^7.24.0",
     "uuid": "^11.1.1",
     "validator": "^13.15.26",