Add an Account page for sign-in methods and signed-in devices

/web/account, offered to everyone, lists every browser and client signed
in as you, with when each was last used, and signs any of them out, or all
but the current one. It sets up, replaces and removes the second factor,
and holds the password form, moved from the vault page. Administrators can
sign a user out everywhere from the People page.

The API gains GET and DELETE /api/v1/auth/sessions and DELETE
/api/v1/auth/totp. Sessions are named by a digest of their token, never the
token, and record when they were last used. Replacing or removing an active
second factor now needs the password and a current code.

Server version 0.10.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/auth.go

@@ -136,54 +136,6 @@ func (s *Server) handleWhoami(w http.ResponseWriter, r *http.Request, u *store.U
 	writeJSON(w, http.StatusOK, out)
 }
 
-func (s *Server) handleTOTPEnroll(w http.ResponseWriter, r *http.Request, u *store.User) {
-	sec := totp.NewSecret()
-	if err := s.st.Update(func(st *store.State) error {
-		target := st.Users[u.ID]
-		if target == nil {
-			return errBadCredentials
-		}
-		target.TOTPSecret = sec
-		target.TOTPConfirmed = false
-		return nil
-	}); err != nil {
-		fail(w, http.StatusInternalServerError, "internal", err.Error())
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]string{
-		"secret": sec,
-		"uri":    totp.URI("KeepOrg", u.Username, sec),
-	})
-}
-
-func (s *Server) handleTOTPConfirm(w http.ResponseWriter, r *http.Request, u *store.User) {
-	var req struct {
-		Code string `json:"code"`
-	}
-	if !readJSON(w, r, &req) {
-		return
-	}
-	err := s.st.Update(func(st *store.State) error {
-		target := st.Users[u.ID]
-		if target == nil || target.TOTPSecret == "" {
-			return errBadCredentials
-		}
-		if !totp.Check(target.TOTPSecret, req.Code, time.Now()) {
-			return errTOTPInvalid
-		}
-		target.TOTPConfirmed = true
-		return nil
-	})
-	switch {
-	case errors.Is(err, errTOTPInvalid):
-		fail(w, http.StatusBadRequest, "totp_invalid", "code rejected")
-	case err != nil:
-		fail(w, http.StatusInternalServerError, "internal", err.Error())
-	default:
-		writeJSON(w, http.StatusOK, map[string]bool{"totp_enabled": true})
-	}
-}
-
 // ---- device login: the browser approves, the client polls ----
 
 func (s *Server) handleDeviceStart(w http.ResponseWriter, r *http.Request) {