Add two-factor authentication to my app using TOTP (the standard authenticator-app flow, compatible with Google Authenticator, Authy, 1Password, etc.). Implement the full lifecycle: enrollment (generate a secret, show it as a QR code and as a manual entry string, require the user to confirm with a valid code before enabling), login (after password succeeds, challenge for the current TOTP code with a small time-window tolerance), recovery codes (generate a set of single-use backup codes at enrollment, show them once, let users regenerate them), and disable (require a password or current 2FA code to turn it off). Rate limit the code verification endpoint the same way as login. Store secrets and recovery codes hashed or encrypted, never in plaintext. Make 2FA optional for existing users unless the app handles money or sensitive data, in which case recommend enforcement for admin accounts at minimum. Do not change the login UI beyond the added challenge step. Use an established TOTP library for my stack rather than writing the algorithm by hand. Deliver the working flow plus a test plan: enroll a test account, sign out, sign back in with a code, use a recovery code, and confirm an incorrect code is rejected and rate limited.