M4-T06: add TOTP second factor to login (totp_code + recovery codes)

app/services/totp.py

@@ -190,6 +190,19 @@ def disable(
     return True
 
 
+def verify_totp_code(user: AuthUser, code: str) -> bool:
+    """Verify a 6-digit TOTP code for a user.
+
+    Returns True if the code is valid (±1 time window), False otherwise.
+    The user must have a ``totp_secret`` set; returns False if not.
+
+    This is the public entry-point for T06 login two-factor verification.
+    """
+    if not user.totp_secret:
+        return False
+    return _verify_totp_code(user.totp_secret, code)
+
+
 def verify_recovery_code(db: Session, *, user: AuthUser, code: str) -> bool:
     """Verify and consume a one-time recovery code.