feat: add TOTP multifactor authentication

README.md

@@ -32,8 +32,23 @@ npm run db:seed-users
 
 The seed creates `Aewyn` and `Quartermaster` with the standard user role. It
 generates and displays strong temporary passwords once, then stores only salted
-Argon2id hashes. The separate bootstrap policy promotes the first authenticated
-account when no administrator exists.
+Argon2id hashes. `DEFAULT_ADMIN_PASSWORD` is the password variable name for
+`Aewyn`; it does not grant administrator authority.
+
+Sign-in never grants administrator authority automatically. For local
+development, give the target account a verified email, enroll TOTP at
+`/account/security`, and save its one-time recovery codes. Stop the development
+server, then run:
+
+```sh
+npm run admin:bootstrap -- <verified-email>
+```
+
+The offline command requires an active TOTP factor and an unused recovery code,
+revokes the target account's sessions, and refuses to run when an active full
+administrator already exists. Restart the development server after it succeeds.
+See [docs/DEPLOYMENT.md](docs/DEPLOYMENT.md) for staging and production
+operation.
 
 ## Develop