Add TOTP 2FA and retroactive rule application

- TOTP-based two-factor authentication (RFC 6238, HMAC-SHA1): setup, enable, disable in Settings → Password & Security
- Login flow: password verified first, then temp token issued for 5-min TOTP window before full session is granted
- QR code generated server-side via `qrcode` package for scanning with any authenticator app
- "Run Rules Now" button in TransactionRulesManager applies auto-categorization rules to existing uncategorized expenses

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

package.json

@@ -10,8 +10,10 @@
   },
   "dependencies": {
     "@types/bcryptjs": "^2.4.6",
+    "@types/qrcode": "^1.5.6",
     "bcryptjs": "^3.0.3",
     "next": "16.1.1",
+    "qrcode": "^1.5.4",
     "react": "19.2.0",
     "react-dom": "19.2.0"
   },