Support IBKR mobile push 2FA config

[Pigbibi]

Summary

• pass optional IBC two-factor device and TOTP auto-fill mode from GitHub vars into the gateway .env
• expose TWOFA_DEVICE in docker-compose for IBKR Mobile push selection
• allow the local 2FA helper to run in passive logging mode when push approval is used
• document the new shared variables

Tests

• python3 -m py_compile 2fa_bot.py
• bash tests/test_install_2fa_bot_watcher.sh
• bash tests/test_wait_for_ib_gateway_ready.sh
• bash tests/test_workflow_shared_config.sh
• bash tests/test_docker_compose_ports.sh

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ce978dedce

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Skip TOTP secret enforcement when auto-fill is disabled

Adding IBKR_2FA_AUTOFILL here introduces a push-approval mode, but the workflow still unconditionally requires TOTP_SECRET later in Check whether deployment config is complete (require_secret_source TOTP_SECRET_SECRET_NAME ...) and again after secret resolution (resolved totp_secret is empty check). In the IBKR_2FA_AUTOFILL=no scenario, users who rely on IBKR Mobile push and have no TOTP seed will fail deployment before the container starts, so the new mode is effectively unusable unless a dummy secret is supplied.

Useful? React with 👍 / 👎.