feat: two-factor authentication (TOTP + recovery codes)

[mpge]

Summary

Adds two-factor authentication (TOTP + recovery codes) to the AdonisJS backend, which previously had no 2FA support (it was referenced only in a code comment). Ports the Laravel/Symfony reference contract.

What's included

• TwoFactorService (src/services/two_factor_service.ts) — RFC-6238 TOTP (HMAC-SHA1, 6 digits, 30s period) implemented with Node's built-in crypto module, no new OTP dependency. Provides:
  • base32 secret generation
  • otpauth:// enrollment URI (for QR display)
  • verify() with a +/- 1 time-slice clock-drift window (constant-time compare)
  • single-use recovery codes (hashed with SHA-256)
  • AES-256-GCM encryption of the secret at rest
• TwoFactor Lucid model (src/models/two_factor.ts) + escalated_two_factor migration — encrypted secret, hashed recovery_codes, confirmed_at; unique per user, mirroring how api_token is modeled. Uses the userIdColumn helper so it honors the host user key type (int/uuid/string).
• AdminTwoFactorController — index, setup, confirm, disable, regenerateRecoveryCodes, plus a post-login challenge/verify path (accepts a TOTP code or a single-use recovery code).
• Routes — management routes under admin/settings/two-factor/*, and an auth-only two-factor/challenge group for the login challenge.

Contract

Generate a TOTP secret → expose an otpauth:// URI for enrollment → confirm by verifying a first code → store secret (encrypted) + hashed recovery codes + confirmed_at → verify a TOTP or recovery code at challenge time → disable + regenerate recovery codes.

Tests

New unit spec tests/unit/two_factor_service.spec.ts (16 tests), including:

• secret generation shape + uniqueness, otpauth URI
• RFC 6238 known-answer TOTP vectors (t=59, 1111111109, 1234567890, 2000000000)
• correct-code accepted (current + prior slice), far-slice + malformed rejected
• recovery-code single-use (a code works once, then is removed)
• secret encrypt/decrypt round-trip

Full suite green with no regressions: 565 node:test tests + 21 Japa tests pass. tsc --noEmit, ESLint, and Prettier (3.9.6) all clean on the changed files.