- Add MFA enrollment UI in new Settings page with QR code and backup secret - Add TOTP challenge step to login flow for enrolled users - Check AAL after login and show TOTP input when aal2 required - Add disable MFA option with TOTP re-verification - Only show MFA options for email/password users (not OAuth) - Add Settings link to user dropdown menu Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>