* preplan otp, better qrcode library
* add 2fa as feature
* add totp generation
* working totp lifecycle
* don't allow disabled user to log in
not a security issue as permission handler would fail anyway
* require 2fa on login
if enabled
* update packages
* fix typo
* remove console.logs
32b73b850a