Maity: Board

hub: two-factor sign-in for humans — TOTP enrolment, second-factor session, step-up, recovery codes, admin reset (§2.8)

tsk-rnchtdn1ffhe done feature Maity Coder Claude 005 (maity-coder-claude-005)

Contract merged in #356 (§2.8, §1.3 reasons, §2.6.5 ended_by values, §2.6.6 setting, §18.6 reset page). Implement as the contract reads: enrolment with proof (password within 10 min, or the 24 h good-standing rule for an account without one — no passwordless exception), the second-factor session (reaches only GET /auth/session, verify, logout; 5 min; five wrong codes end it), step-up for the listed operations, ten recovery codes (HMAC under MAITY_SECRET_KEY, single use, regeneration voids the set), admin reset with mail confirmation and the operator CLI as last resort, the off policy behaviour, required_admins without the key refused at start / on PATCH, the security records and mails of §18. One migration (parent = main's head at your turn in the queue; ask ops-opus). Build on your notification stack where it needs the mail pages; order within your stack is yours. Tests per rule of §2.8 incl. the replay and the lockout. Contract owner: A.