feat: upgrade auth to email+password with optional TOTP MFA

- Replace magic-link-only login with email+password (primary) and magic link (toggle)
- Add registration page with strong password validation
- Add MFA enrollment (/mfa/enroll) with QR code and manual secret
- Add MFA verification (/mfa/verify) with 6-digit TOTP input
- Add password reset flow (/reset-password)
- Add middleware MFA enforcement gated by NEXT_PUBLIC_REQUIRE_MFA env var
- Self-hosted deployments (NEXT_PUBLIC_SELF_HOSTED=true) skip MFA entirely
- Add Security tab in Settings for password change and MFA management
- Add requireAuth() API route helper with MFA check
- Update CLAUDE.md with Authentication section and env var docs
- Update Dockerfile and docker-entrypoint.sh for new env var placeholders

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/auth/mfa.ts

@@ -0,0 +1,11 @@
+/**
+ * MFA (Multi-Factor Authentication) helpers.
+ *
+ * MFA is only required on the hosted version, never for self-hosted deployments.
+ * Enforcement is application-side (middleware + API routes), not RLS.
+ */
+
+export function isMfaRequired(): boolean {
+  if (process.env.NEXT_PUBLIC_SELF_HOSTED === 'true') return false
+  return process.env.NEXT_PUBLIC_REQUIRE_MFA === 'true'
+}

lib/auth/require-auth.ts

@@ -0,0 +1,40 @@
+import { createClient } from '@/lib/supabase/server'
+import { NextResponse } from 'next/server'
+import { isMfaRequired } from './mfa'
+import type { User, SupabaseClient } from '@supabase/supabase-js'
+
+type AuthResult =
+  | { user: User; supabase: SupabaseClient; error: null }
+  | { user: null; supabase: SupabaseClient; error: NextResponse }
+
+/**
+ * Auth + MFA guard for API routes.
+ *
+ * Returns the authenticated user and Supabase client, or a JSON error response.
+ * When MFA is required (hosted deployment), verifies AAL2 assurance level.
+ */
+export async function requireAuth(): Promise<AuthResult> {
+  const supabase = await createClient()
+  const { data: { user } } = await supabase.auth.getUser()
+
+  if (!user) {
+    return {
+      user: null,
+      supabase,
+      error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+    }
+  }
+
+  if (isMfaRequired()) {
+    const { data: aal } = await supabase.auth.mfa.getAuthenticatorAssuranceLevel()
+    if (aal?.nextLevel === 'aal2' && aal?.currentLevel !== 'aal2') {
+      return {
+        user: null,
+        supabase,
+        error: NextResponse.json({ error: 'MFA verification required' }, { status: 403 }),
+      }
+    }
+  }
+
+  return { user, supabase, error: null }
+}