Add 2FA support

[jedi58]

• Add tab to user for enrolment
• Enforce requirement through Roles,
• Support for Recovery Codes
• Ensure sign-in forces use of 2FA if 2FA is enabled for account
• Redirect to 2FA enrolment if user's role requires 2FA but is not enrolled

[jedi58]

Remaining tasks:

• Forced enrolment based on Role
• Trusted devices
• Move login activity into service so it's only called when login complete, not using subscriber as is now
• CLI command for encryption key rotation
• May want abstract out authentication challenge ready for Passkey inclusion