Security and sessions

A security page with a guided two-factor setup (app, QR code, verify, recovery codes), a passkeys list, active sessions with per-device sign-out and a sign-out-everywhere confirmation.