R3 two-factor in decePub: an authenticator app set up in Settings, its code asked for at sign-in

Completion program R3, with PrivaPub's TOTP routes of the same release.

- Settings, the login: TotpEditor turns two-factor sign-in on (the password, then the QR code, the secret and the
  otpauth:// link, then the app's first code; the ten recovery codes shown once with Copy), shows how many recovery
  codes are left (warned at three), and turns it off with the password and a code, asked first.
- Turning it on, like a password change, ends every other session: AuthService.ContinueSession takes the new JWT and
  exchanges the persona's token again.
- Sign-in: PrivaPub's 428 keeps the name and password and asks for the six digits (DOtp), or a recovery code instead;
  a wrong code says so; Back returns to the password.
- window.copyText (main.js) through AppStatusService.CopyText.
- 29 keys in both resx files; CLAUDE.md follows.

Verified: dotnet build decePubClient.csproj -c Release (0 errors, no new warnings).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

Models/APIs.cs

@@ -27,6 +27,9 @@ public static class APIs
 		public const string POST_Email = "clientapi/user/email";
 		public const string POST_EmailVerify = "clientapi/user/email/verify";
 		public const string POST_EmailRemove = "clientapi/user/email/remove";
+		public const string POST_TotpSetup = "clientapi/user/totp/setup";
+		public const string POST_TotpEnable = "clientapi/user/totp/enable";
+		public const string POST_TotpDisable = "clientapi/user/totp/disable";
 		public const string GET_UserSettings = "clientapi/user/settings";
 		public const string POST_UpdateUserSettings = "clientapi/user/update/settings";
 		public const string POST_DeleteAccount = "clientapi/user/delete";