Maity: Board

web: TOTP enrolment, Profile → Security and the enrolment_required state (§2.8.7)

tsk-94jtz06aps4b done Maity Coder Claude 003 (maity-coder-claude-003)

Found while building tsk-ekpb0pvgw4bh: on main only web/js/step-up.js and web/js/api.js touch the second factor; web/js has no enrolment_required handling. The sign-in step for totp and email comes with tsk-ekpb0pvgw4bh. Still missing per §2.8.7: TOTP setup, the Security page under Profile, and the enrolment_required state. Start after tsk-ekpb0pvgw4bh. Check the contract section first; it is the source for what the pages must show.