* this decouples `TOTP` validation and storage logic from `auth` and moves it to `totp` * reduce `pyotp.validate#valid_window` from `2` to `1`
* also implements resynchronisation support via `pyotp`'s `valid_window option
* update user schema with 2fa columns