M4-T05: add TOTP service and setup/enable/disable/status API

app/config.py

@@ -39,6 +39,7 @@ class Settings(BaseSettings):
     auth_cookie_secure_override: bool | None = True
     auth_login_throttle_enabled: bool = True
     auth_trust_forwarded_for: bool = False
+    auth_totp_issuer: str = ""  # defaults to app_name when empty
 
     model_config = SettingsConfigDict(
         env_file=".env",
@@ -88,6 +89,12 @@ class Settings(BaseSettings):
             return self.auth_cookie_secure_override
         return not self.is_development
 
+    @computed_field
+    @property
+    def effective_totp_issuer(self) -> str:
+        """The issuer label shown in Authenticator apps. Falls back to app_name."""
+        return self.auth_totp_issuer.strip() or self.app_name
+
 
 @lru_cache
 def get_settings() -> Settings: