Fix SEC-01: require password for TOTP enroll

- REST handleTOTPEnroll now requires password field in request body
- gRPC EnrollTOTP updated with password field in proto message
- Both handlers check lockout status and record failures on bad password
- Updated Go, Python, and Rust client libraries to pass password
- Updated OpenAPI specs with new requestBody schema
- Added TestTOTPEnrollRequiresPassword with no-password, wrong-password,
  and correct-password sub-tests

Security: TOTP enrollment now requires the current password to prevent
session-theft escalation to persistent account takeover. Lockout and
failure recording use the same Argon2id constant-time path as login.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

clients/rust/tests/client_tests.rs

@@ -449,7 +449,7 @@ async fn test_enroll_totp() {
         .await;
 
     let c = admin_client(&server).await;
-    let (secret, uri) = c.enroll_totp().await.unwrap();
+    let (secret, uri) = c.enroll_totp("testpass123").await.unwrap();
     assert_eq!(secret, "JBSWY3DPEHPK3PXP");
     assert!(uri.starts_with("otpauth://totp/"));
 }