Summary

• Upgrade better-auth and @better-auth/api-key to 1.6.23.
• Add authenticator-app TOTP two-factor auth with Better Auth server/client plugins.
• Add /two-factor challenge flow, Security settings UI for enable/verify/disable/regenerate backup codes, and matching Drizzle schema.
• Harden auth redirect handling and add helper regression tests.

Validation

• CI=true pnpm test passed: 73 tests.
• CI=true pnpm exec tsc --noEmit passed.
• Targeted CI=true pnpm exec biome check ... passed for touched TS/TSX/schema/test files.
• CI=true pnpm build passed. Local build emitted expected Better Auth env warnings because BETTER_AUTH_URL and BETTER_AUTH_SECRET were not set in this shell.

Notes

• Scope is authenticator-app TOTP only; no email or SMS OTP.
• No live database push was run from this local environment.