feat(auth): v2.1.0 - MFA TOTP avec QR code, recovery codes

- backend/auth/mfa.py: TOTP (pyotp), recovery codes SHA-256
- Login flow: mfa_required → totp/verify → token (ou recovery)
- 6 nouveaux endpoints /api/auth/mfa/*
- Frontend: QR code setup, 6-digit auto-submit, recovery codes
- Settings: section Sécurité avec enable/disable MFA
- CSS: mfa-challenge, setup-card, recovery-list, badges
- i18n: 36 nouvelles clés EN/FR
- pyotp ajouté aux dépendances
- 30 tests (TOTP, recovery, API endpoints, login flow)
- 439 tests passent au total

frontend/locales/en.json

@@ -1377,7 +1377,14 @@
   "theme.change": "Change theme",
   "theme.dark": "Dark",
   "theme.light": "Light",
+  "theme.high_contrast": "High Contrast",
+  "theme.sepia": "Sepia",
   "theme.title": "Theme",
+  "theme.export_all": "Export Themes",
+  "theme.import": "Import Theme",
+  "theme.import_success": "{count} theme(s) imported",
+  "theme.import_error": "Import error",
+  "theme.delete_confirm": "Delete this custom theme?",
   "themes.name_gradients": "Subtle gradients",
   "themes.name_terminal": "Pure black & green",
   "toast.ai_keys_saved": "API keys saved",
@@ -1465,6 +1472,14 @@
   "viewer.download_pdf": "Download as PDF",
   "viewer.edit": "Edit",
   "viewer.error": "Loading error",
+  "viewer.export": "Export",
+  "viewer.export_done": "Export complete",
+  "viewer.export_epub": "Export as ePub",
+  "viewer.export_error": "Export error:",
+  "viewer.export_html": "Export as HTML",
+  "viewer.export_md_bundle": "Export as Markdown bundle (.zip)",
+  "viewer.export_start": "Exporting...",
+  "viewer.export_title": "Export document",
   "viewer.forge_brand": "Forge",
   "viewer.forge_title": "Forge (new editor)",
   "viewer.index_start": "Starting index...",
@@ -1495,5 +1510,41 @@
   "webhook.trigger_dir_create": "Directory creation via API",
   "webhook.trigger_dir_delete": "Directory deletion via API",
   "webhook.trigger_dir_rename": "Directory rename via API",
-  "webhook.trigger_rename": "Rename via API"
+  "webhook.trigger_rename": "Rename via API",
+  "settings.security": "🔒 Account Security",
+  "settings.security_desc": "Enable two-factor authentication (2FA) to strengthen your account security.",
+  "mfa.title": "Two-Factor Authentication",
+  "mfa.subtitle": "Enter the 6-digit code from your authenticator app.",
+  "mfa.verify": "Verify",
+  "mfa.verifying": "Verifying...",
+  "mfa.use_recovery": "Use a recovery code",
+  "mfa.back_to_login": "Back to login",
+  "mfa.recovery_title": "Recovery Code",
+  "mfa.recovery_subtitle": "Enter one of your recovery codes (format: XXXX-XXXX).",
+  "mfa.use_totp": "Use authenticator code",
+  "mfa.status_label": "Two-Factor Authentication",
+  "mfa.enabled": "Enabled",
+  "mfa.disabled": "Disabled",
+  "mfa.enabled_desc": "Your account is protected by two-factor authentication.",
+  "mfa.setup_desc": "Add an extra layer of security to your account with TOTP.",
+  "mfa.enable_btn": "Enable 2FA",
+  "mfa.disable_btn": "Disable 2FA",
+  "mfa.scan_qr": "Scan this QR code with your authenticator app",
+  "mfa.manual_entry": "Manual entry (if you can't scan)",
+  "mfa.enter_code": "Enter the 6-digit code to confirm",
+  "mfa.confirm_enable": "Confirm & Enable",
+  "mfa.recovery_codes_title": "Recovery Codes",
+  "mfa.recovery_codes_warning": "Save these codes in a secure place. Each code can only be used once.",
+  "mfa.copy_codes": "Copy",
+  "mfa.download_codes": "Download",
+  "mfa.done": "Done",
+  "mfa.codes_copied": "Recovery codes copied!",
+  "mfa.disable_confirm_title": "Disable 2FA",
+  "mfa.disable_confirm_desc": "Enter your password and a valid TOTP code to disable two-factor authentication.",
+  "mfa.password_label": "Password",
+  "mfa.password_placeholder": "Your current password",
+  "mfa.totp_code_label": "TOTP Code",
+  "mfa.disable_confirm_btn": "Disable 2FA",
+  "mfa.disabled_success": "2FA has been disabled.",
+  "mfa.fill_all_fields": "Please fill in all fields."
 }