Add Two-Factor Authentication (TOTP)

[Mkalbani]

Description

Implement optional two-factor authentication using TOTP (Time-based One-Time Password, compatible with Google Authenticator and Authy). For players with NFT assets and on-chain rewards tied to their accounts, 2FA provides meaningful protection against account takeover. The flow should be opt-in, with a clear setup, verification, and disable lifecycle.

Acceptance Criteria

• POST /auth/2fa/setup generates a TOTP secret and returns a QR code URI
• POST /auth/2fa/enable verifies the first TOTP code and enables 2FA on the account
• POST /auth/2fa/verify is required after login when 2FA is enabled, before a JWT is issued
• POST /auth/2fa/disable requires a valid TOTP code to turn off 2FA
• TOTP secret is stored encrypted at rest
• Backup codes (one-time use) are generated during setup for account recovery
• Accounts with 2FA enabled that skip the verify step receive a 403 with a descriptive message
• Unit tests cover setup, enable, verify success/failure, disable, and backup code usage

[Dickson2015]

The issue description is crystal clear. Maintainer I would love to work on this issue.

[grantfox-oss]

🦊 GrantFox — @Dickson2015 has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #78)
2. Your PR will be reviewed by the MindFlowInteractive maintainers

Good luck! Track your progress on GrantFox.