feat(02-03): add TOTP setup/enable/disable, password reset, and frontend_url to config

- GET /api/auth/totp/setup: returns provisioning_uri + secret (400 if already enabled)
- POST /api/auth/totp/enable: rate-limited 10/min, verifies TOTP code with Redis replay prevention, returns 10 backup codes
- DELETE /api/auth/totp: disables TOTP, clears secret, deletes backup codes
- POST /api/auth/password-reset: always returns 202 (anti-enumeration), enqueues Celery email task
- POST /api/auth/password-reset/confirm: validates token, strength, HIBP; updates password; no auto-login (AUTH-05)
- config.py: added frontend_url setting for password reset link construction
- test_auth_totp.py: all 11 tests passing (GREEN)

backend/config.py

@@ -50,6 +50,9 @@ class Settings(BaseSettings):
     # CORS (Phase 2 — D-09)
     cors_origins: list[str] = ["http://localhost:5173"]
 
+    # Frontend URL — used to build password reset links (D-02, D-03)
+    frontend_url: str = "http://localhost:5173"
+
 
 settings = Settings()