feat(mfa): second-factor sign-in with TOTP and recovery codes

server/internal/api/handlers.go

@@ -43,6 +43,8 @@ func RegisterRoutes(r *gin.Engine) {
 	r.GET("/auth/bootstrap-status", auth.HandleBootstrapStatus)
 	r.POST("/auth/bootstrap", auth.HandleBootstrap)
 	r.POST("/auth/login", auth.HandleLocalLogin)
+	r.POST("/auth/mfa/totp", auth.HandleMFATOTP)
+	r.POST("/auth/mfa/recovery", auth.HandleMFARecovery)
 	r.POST("/auth/logout", auth.HandleLogout)
 	r.GET("/auth/me", auth.HandleMe)
 	r.GET("/auth/oidc/:providerId/start", auth.HandleSSOStart)