feat(auth): implement TOTP two-factor authentication with enrollment and verification

Adds TOTP (Time-based One-Time Password) two-factor authentication support including:
- New TOTP service with secret generation, QR code provisioning, and code verification
- New auth endpoints for enrollment, verification, status, and backup code management
- New TOTP authentication method type and user methods for TOTP management
- Backup codes generation and verification for account recovery
- Updated OIDC endpoints with timezone-aware datetime handling and RFC-compliant responses
- Added "roles" scope support for OIDC userinfo and ID tokens
- New pyotp dependency for TOTP operations
- Comprehensive unit tests for TOTP service

requirements/base.txt

@@ -16,6 +16,7 @@ marshmallow-sqlalchemy==0.29.0
 # Security
 bcrypt==4.1.2
 Flask-Bcrypt==1.0.1
+pyotp==2.9.0
 
 # JWT / OIDC
 PyJWT==2.8.0