feat(2fa): implement two-factor authentication

[FrankApiyo]

Changes / Features implemented

Two-factor authentication moves into onadata. Login runs through the wizard at /account/login/ for everyone, and /accounts/login/ redirects to it rather than rendering a password-only form beside it. Enrolment stays off until a deployment sets ENABLE_TWO_FACTOR.

• /api/v1/totp/: status, enroll/start, enroll/confirm, disable, verify, recovery/generate, recovery. Anything that weakens or replaces a factor needs a current code, or a grant verify minted for that one operation. Responses carry Cache-Control: no-store.
• First enrolment has no factor to challenge, so it asks for the account password instead — behind TWO_FACTOR_ENROLMENT_REQUIRES_PASSWORD, off by default because a deployment whose users authenticate elsewhere may hold hashes nobody knows.
• The failed-login lockout now covers both wizard steps. Only the credentials step counted before, leaving whoever held the password an unbounded run at a six-digit code.
• Only login is served from the two-factor URLConf. Why the library's own pages are not is in two_factor_urls.py.

Also: is_owner resolves LOGIN_URL, which is a URL name now; django-two-factor-auth, django-otp and qrcode become declared dependencies rather than deployment-only ones; pyproject.toml stops ruff and isort reordering imports against each other; and two existing tests stop hard-coding /accounts/login.

Steps taken to verify this change does what is intended

Tests are driven through the wizard's own POSTs rather than against the forms, with codes from a real HOTP implementation — patching verify_token would pass against a device no authenticator app agrees with. Code verification is covered by TransactionTestCase concurrency tests, since the race they guard needs committed data on a second connection.

Exercised by hand against a running stack: enrol, sign in with a code, and sign in as a user with no factor.

Side effects of implementing this change

• An account with no second factor sees a one-step password form, so nothing changes for a user until they enrol.
• One-time codes are spent under a row lock. Without it, workers being separate processes meant a single-use recovery code was honoured once per racing caller.
• Enabling django.contrib.admin is safe: the library redirects /admin/login/ to LOGIN_URL. Reaching /admin/ still needs only staff permission, so a staff user who has not enrolled gets in on a password alone.
• feat(2fa): implement step-up authentication #3215 is stacked on this branch.

Before submitting this PR for review, please make sure you have:

• Included tests
• Updated documentation

Closes #