Phase 16: hardening and release 0.1.0

- TOTP second factor (RFC 6238, secret encrypted under the master key),
  ten hashed single-use recovery codes, two-step login with a pending token
  bound to the client address, account enrolment/disable, admin reset
- tests/security: prompt-injection corpus never acts or creates evidence-free
  beliefs; roles and CSRF on form and API paths; cross-mind isolation
  (demo scenario 5); stored-XSS escaping and CSP across pages; secrets never
  echoed (API, pages, database, archives); hostile archive import; session
  lifecycle and security headers
- OpenAPI 3.1 document generated from the route table, served at
  /api/v1/openapi.json and kept complete by a test
- gosec clean (justified #nosec annotations, cookie/redirect hardening,
  bounded multipart parsing, UUID packing without narrowing conversions);
  govulncheck clean with toolchain pinned to go1.26.8
- THREAT_MODEL verification pointers, SECURITY.md testing section, README,
  CHANGELOG 0.1.0, docs/RELEASE_NOTES.md, PLAN status

web/templates/pages/account.html

@@ -25,6 +25,20 @@
       <p class="muted small">Other sessions are signed out when the password changes.</p>
     </form>
   </div>
+  <div class="card" id="totp">
+    <h2>Two-factor authentication</h2>
+    {{if .Data.RecoveryCodes}}<div class="highlight"><p><strong>Recovery codes.</strong> Store these somewhere safe; each works once and they are not shown again.</p><pre class="token"><code>{{range .Data.RecoveryCodes}}{{.}}
+{{end}}</code></pre></div>{{end}}
+    {{if .Data.TOTPEnabled}}<p><span class="badge ok">enabled</span> {{.Data.RecoveryLeft}} recovery code(s) left.</p>
+      <form method="post" action="/account/totp/disable" class="stack"><input type="hidden" name="_csrf" value="{{.CSRF}}"><label>Current password <input type="password" name="current" required autocomplete="current-password"></label><button class="btn btn-danger" data-confirm="Disable two-factor authentication?">Disable</button></form>
+      <form method="post" action="/account/totp/begin" class="stack"><input type="hidden" name="_csrf" value="{{.CSRF}}"><button class="btn">Re-enrol (new secret and codes)</button></form>
+    {{else if .Data.TOTPSecret}}<p>Add this secret to your authenticator app, then confirm with a code.</p>
+      <p class="mono small">Secret: <code>{{.Data.TOTPSecret}}</code></p><p class="small muted break">URI: <code>{{.Data.TOTPURI}}</code></p>
+      <form method="post" action="/account/totp/confirm" class="row"><input type="hidden" name="_csrf" value="{{.CSRF}}"><input name="code" inputmode="numeric" autocomplete="one-time-code" placeholder="123456" required maxlength="6"> <button class="btn btn-primary">Confirm and enable</button></form>
+    {{else if .Data.TOTPAvailable}}<p class="muted small">Off. Enabling it adds a code from an authenticator app to every sign-in and gives you ten single-use recovery codes.</p>
+      <form method="post" action="/account/totp/begin"><input type="hidden" name="_csrf" value="{{.CSRF}}"><button class="btn btn-primary">Enable</button></form>
+    {{else}}<p class="muted small">Unavailable: the server has no <code>NOEMA_MASTER_KEY</code>, so the secret could not be stored encrypted.</p>{{end}}
+  </div>
   <div class="card">
     <h2>API tokens</h2>
     <table class="table compact">