MFA, OTP, email verification, and staff controls

Implementation checklist

• Staff routes require MFA in production
• Recovery codes and trusted devices planned
• Login rate limits use Redis prefix
• Turnstile can be required for register/login/forms
• Audit logs capture sensitive actions