Green: prefer TOTP via twoFactorSessionIDV2 when passkey also enrolled

beginLogin now checks twoFactorSessionID ?? twoFactorSessionIDV2 before
the passkey branch. Accounts with both passkeys and TOTP can now log in
from the CLI using their authenticator app.

src/auth/login.ts

@@ -73,8 +73,14 @@ const srpHandshake = async (
 
     srpClient.checkM2(Buffer.from(verifyResponse.srpM2, "base64"));
 
-    if (verifyResponse.twoFactorSessionID) {
-        return { kind: "totp", sessionID: verifyResponse.twoFactorSessionID };
+    // twoFactorSessionIDV2 is set (instead of twoFactorSessionID) when the
+    // account has BOTH passkeys and TOTP. Prefer TOTP: a CLI cannot perform
+    // a WebAuthn ceremony, and the user has a TOTP secret enrolled.
+    const totpSessionID =
+        verifyResponse.twoFactorSessionID ??
+        verifyResponse.twoFactorSessionIDV2;
+    if (totpSessionID) {
+        return { kind: "totp", sessionID: totpSessionID };
     }
     if (verifyResponse.passkeySessionID) {
         return {