Add TOTP enrollment to web UI

- Profile page TOTP section with enrollment flow:
  password re-auth → QR code + manual entry → 6-digit confirm
- Server-side QR code generation (go-qrcode, data: URI PNG)
- Admin "Remove TOTP" button on account detail page
- Enrollment nonces: sync.Map with 5-minute TTL, single-use
- Template fragments: totp_section.html, totp_enroll_qr.html
- Handler: handlers_totp.go (enroll start, confirm, admin remove)

Security: Password re-auth before secret generation (SEC-01).
Lockout checked before Argon2. CSRF on all endpoints. Single-use
enrollment nonces with expiry. TOTP counter replay prevention
(CRIT-01). Self-removal not permitted (admin only).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

PROGRESS.md

@@ -4,6 +4,23 @@ Source of truth for current development state.
 ---
 Phases 0–14 complete. **v1.0.0 tagged.** All packages pass `go test ./...`; `golangci-lint run ./...` clean.
 
+### 2026-03-16 — TOTP enrollment via web UI
+
+**Task:** Add TOTP enrollment and management to the web UI profile page.
+
+**Changes:**
+- **Dependency:** `github.com/skip2/go-qrcode` for server-side QR code generation
+- **Profile page:** TOTP section showing enabled status or enrollment form
+- **Enrollment flow:** Password re-auth → generate secret → show QR code + manual entry → confirm with 6-digit code
+- **QR code:** Generated server-side as `data:image/png;base64,...` URI (CSP-compliant)
+- **Account detail:** Admin "Remove TOTP" button with HTMX delete + confirm
+- **Enrollment nonces:** `pendingTOTPEnrolls sync.Map` with 5-minute TTL, single-use
+- **Template fragments:** `totp_section.html`, `totp_enroll_qr.html`
+- **Handler:** `internal/ui/handlers_totp.go` with `handleTOTPEnrollStart`, `handleTOTPConfirm`, `handleAdminTOTPRemove`
+- **Security:** Password re-auth (SEC-01), lockout check, CSRF, single-use nonces, TOTP counter replay prevention (CRIT-01)
+
+---
+
 ### 2026-03-16 — Phase 14: FIDO2/WebAuthn and Passkey Authentication
 
 **Task:** Add FIDO2/WebAuthn support for passwordless passkey login and security key 2FA.