R3 two-factor in decePub: an authenticator app set up in Settings, its code asked for at sign-in

Completion program R3, with PrivaPub's TOTP routes of the same release.

- Settings, the login: TotpEditor turns two-factor sign-in on (the password, then the QR code, the secret and the
  otpauth:// link, then the app's first code; the ten recovery codes shown once with Copy), shows how many recovery
  codes are left (warned at three), and turns it off with the password and a code, asked first.
- Turning it on, like a password change, ends every other session: AuthService.ContinueSession takes the new JWT and
  exchanges the persona's token again.
- Sign-in: PrivaPub's 428 keeps the name and password and asks for the six digits (DOtp), or a recovery code instead;
  a wrong code says so; Back returns to the password.
- window.copyText (main.js) through AppStatusService.CopyText.
- 29 keys in both resx files; CLAUDE.md follows.

Verified: dotnet build decePubClient.csproj -c Release (0 errors, no new warnings).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

CLAUDE.md

@@ -261,9 +261,15 @@ Never redeclare the base's members in a component.
   forgets the session.
   - **Sessions:** "Sign out everywhere" (`AuthService.LogoutEverywhere`, `/clientapi/user/logout/everywhere`) ends every
     session of the login, this one too, and PrivaPub revokes every persona's token with them, so the client only forgets
-    its own and signs out. A password change ends every other session and revokes every persona token, this device's
-    too: `AuthService.ChangePassword` keeps the new `JwtUser` PrivaPub answers with, drops the stored persona tokens and
-    exchanges one for the current persona at once (the others when next used), so the device stays signed in.
+    its own and signs out. A password change, and turning two-factor sign-in on, end every other session and revoke every
+    persona token, this device's too: `AuthService.ChangePassword` and `TotpEnable` keep the new `JwtUser` PrivaPub
+    answers with (`ContinueSession`), drop the stored persona tokens and exchange one for the current persona at once
+    (the others when next used), so the device stays signed in.
+  - **Two-factor sign-in** (TOTP, `/clientapi/user/totp/*`): with it on, a right password is answered with a 428
+    (`AuthService.NeedsOneTimeCode`). Login keeps the name and the password in the form, out of sight, and sends it again
+    with `LoginForm.OneTimeCode`: the authenticator app's six digits (`DOtp`, `data-login-code`) or, after "Use a recovery
+    code instead", a recovery code like `abcde-fghjk` (a text field, `data-login-recovery`). A wrong code is a 400, like a
+    wrong password, with PrivaPub's message. It is turned on and off in Settings (`TotpEditor`, see **Settings**).
 - **The ways in** (sign-up is closed on PrivaPub; owner decision 2026-10-16):
   - **Setup** (`Pages/Setup.razor` at `/setup`): while PrivaPub has no administrator (`/clientapi/user/setup`), the first
     login is made there, first come, first served, with its first persona. It becomes the administrator, and setup
@@ -362,7 +368,13 @@ Never redeclare the base's members in a component.
   (`/clientapi/user/account`), set only with the password and a 6-digit code mailed to the new address (`/user/email`,
   then `/email/verify` through `DOtp`; the old `/user/update` is refused), shown verified or not and with an address
   waiting for its code, and removed with the password (`/email/remove`); a wrong password is PrivaPub's 403, read as
-  such; its password changed; every session of it ended ("Sign out everywhere", see **One sign-in**); or the whole of it
+  such; its password changed; its two-factor sign-in (`TotpEditor`, a block of AccountEditor that reads the login itself:
+  turned on with the password (`/totp/setup`), which shows the secret as a QR image, as selectable text and as an
+  `otpauth://` link an authenticator app opens, then the app's first code (`/totp/enable`, a 409 once the hour-long
+  setup expired), after which the ten recovery codes are shown once, with Copy (`AppStatusService.CopyText`) and "I saved
+  them"; on, it shows how many recovery codes are left, warns from three down, and is turned off, asked first, with the
+  password and a code from the app or a recovery code (`/totp/disable`)); every session of it ended ("Sign out
+  everywhere", see **One sign-in**); or the whole of it
   deleted, every persona with it, through `/clientapi/user/update/password` and `/clientapi/user/delete`; the client then
   signs out), the persona's profile (`ProfileEditor`:
   `update_credentials` as multipart, its words as written from `Account.Source`, pictures (streamed from the file,