Add 4 files, update 14 files

.env.example

@@ -17,6 +17,9 @@ PASSWORD_RESET_TTL_SECONDS=3600
 AUTH_REQUIRE_EMAIL_VERIFICATION=false
 # Development-only: return reset tokens in API responses instead of email.
 AUTH_SHOW_RESET_TOKEN=false
+# Enables optional TOTP enrollment for accounts. Users without enrollment can
+# continue to sign in normally.
+AUTH_TOTP_ENABLED=true
 SCHULOS_PORT=3000
 
 # Local filesystem storage. Docker Compose maps these paths to a persistent volume.