Summary

• require the existing TOTP step-up confirmation before project and server deletion
• centralize server-side deletion confirmation across project, server, and service actions
• reuse one client confirmation dialog while preserving resource-specific deletion behavior and service backup warnings
• handle stale client sessions and validate the TOTP payload at the server boundary

Why

Project deletion cascades through services, so it could previously bypass the service-level 2FA confirmation. Server deletion also lacked the same destructive-action protection. This makes the policy consistent without changing accounts that do not have 2FA enabled.

Validation

• Smart Review completed; diff-introduced findings addressed
• Biome check passed
• TypeScript --noEmit passed
• focused Vitest passed: tests/two-factor.test.ts (5 tests)
• git diff --check passed

Review note

The existing direct Better Auth TOTP throttling behavior is unchanged. This PR intentionally centralizes the currently merged service-delete policy without reintroducing the lockout implementation recently removed from main.

Related

• Delete project required 2FA
• Delete server requires 2FA