v1.1 login: password + optional TOTP second factor (per PO enrollment state). Enroll TOTP via /ui/totp/enroll after first login.