Add per-user TOTP 2FA, client-level user assignment, self-service portal

- TOTP (RFC 6238, stdlib-only) enrollment in profile, login step-up,
  admin emergency reset.
- Admins can grant a user visibility into individual clients
  (User.ClientIDs) in addition to whole-server access (User.ServerIDs).
- New "My Access" page: non-admin users see only their assigned clients
  (view/QR/download only, no management), reachable from the main nav.
- GetUser/GetUsers now redact TOTPSecret before returning JSON.

No Go toolchain was available while writing this - not yet build-verified.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PvrfUytqd74H6WcQkRzFM4

model/user.go

@@ -11,4 +11,14 @@ type User struct {
 	// Empty/nil means no server access at all (secure by default).
 	// Admins always have access to every server regardless of this field.
 	ServerIDs []string `json:"server_ids,omitempty"`
+	// ClientIDs grants a non-admin user visibility into these individual
+	// clients regardless of which server they belong to, in addition to
+	// whatever ServerIDs already grants full-server visibility into.
+	ClientIDs []string `json:"client_ids,omitempty"`
+	// TOTPSecret is the base32-encoded shared secret for this user's TOTP
+	// two-factor login (RFC 6238). Empty means 2FA is not enrolled.
+	TOTPSecret string `json:"totp_secret,omitempty"`
+	// TOTPEnabled gates whether TOTP is actually required at login. A user
+	// can have a secret provisioned but not yet confirm/enable it.
+	TOTPEnabled bool `json:"totp_enabled,omitempty"`
 }