Add TOTP/2FA support for SSH keyboard-interactive auth

Automatically generate and submit TOTP codes during SSH keyboard-interactive
authentication when a secret is configured for the profile.

Backend:
- Add TOTPSecret field to SSHConfig model
- Detect TOTP/2FA prompts in keyboard-interactive handler using keyword
  matching (verification code, otp, authenticator, 2fa, etc.)
- Generate 6-digit TOTP codes using pquerna/otp library
- Retrieve TOTP secret from vault during connection (keychain or file vault)
- API: SetTOTPSecret, GetTOTPCode, HasTOTPSecret, DeleteTOTPSecret

Frontend:
- Add TOTP/2FA section to SSH profile editor (collapsed by default)
- Password-masked secret input with show/hide toggle
- Save button: encrypts and stores in vault
- Test button: generates a live 6-digit code (shown for 5 seconds)
- Delete button: removes stored secret
- Auto-detect whether secret is already saved (placeholder indicator)
- CSS for TOTP input row, danger button style

frontend/src/css/forms.css

@@ -670,3 +670,34 @@
     display: flex;
     gap: var(--space-2);
 }
+
+/* -----------------------------------------------------------------------
+   TOTP / 2FA — secret input row with action buttons
+   ----------------------------------------------------------------------- */
+.totp-input-row {
+    display: flex;
+    gap: var(--space-2);
+    align-items: center;
+}
+
+.totp-input-row .form-input {
+    flex: 1;
+}
+
+.totp-toggle,
+.totp-test,
+.totp-save,
+.totp-delete {
+    flex-shrink: 0;
+    white-space: nowrap;
+}
+
+.btn-danger {
+    background: var(--error);
+    color: #fff;
+    border: 1px solid transparent;
+}
+
+.btn-danger:hover {
+    background: #d32f2f;
+}