feat: add complete MFA support

Add complete MFA support with TOTP, recovery codes, WebAuthn, trusted-device cookie flow, and email/SMS OTP delivery via notification channels. Security follow-up: trusted device tokens are stored in HttpOnly cookies, and SMS OTP reuses the existing Webhook notifier to avoid introducing a new dynamic URL sink.

web/src/types/auth.ts

@@ -2,12 +2,27 @@ export interface AuthUser {
   id: number;
   username: string;
   displayName: string;
+  email?: string;
+  phone?: string;
   role: string;
+  mfaEnabled?: boolean;
+  twoFactorEnabled?: boolean;
+  twoFactorRecoveryCodesRemaining?: number;
+  webAuthnEnabled?: boolean;
+  webAuthnCredentialCount?: number;
+  trustedDeviceCount?: number;
+  emailOtpEnabled?: boolean;
+  smsOtpEnabled?: boolean;
 }
 
 export interface LoginPayload {
   username: string;
   password: string;
+  twoFactorCode?: string;
+  webAuthnAssertion?: unknown;
+  trustedDeviceToken?: string;
+  rememberDevice?: boolean;
+  trustedDeviceName?: string;
 }
 
 export interface LoginResult {