Add Two-Factor Authentication (2FA) with OTP Authenticator Support

[Scrrrratchy]

It would be great to have built-in support for two-factor authentication (2FA) using time-based OTP (TOTP), e.g., with Microsoft or Google Authenticator.
This could be offered as an option in user profiles to increase security for all users.
Optionally, admins should be able to enforce 2FA for all users via a configuration setting or ENV variable.