feat: MFA (TOTP) und Self-Service-Profilseite

Benutzer koennen jetzt selbst Zwei-Faktor-Authentifizierung einrichten
und ihr Profil verwalten (Name, E-Mail, Passwort, Profilbild).

Backend:
- Neues MfaModule (src/auth/mfa/): AES-256-GCM-verschluesselte
  TOTP-Secrets (otplib), QR-Code-Erzeugung, kurzlebige Setup-/
  Challenge-JWTs fuer den 2-Schritt-Login-Flow
- Neues ProfileModule (src/profile/): PATCH /profile,
  POST /profile/password, POST/DELETE/GET /profile/avatar,
  POST /profile/mfa/enroll(/confirm), POST /profile/mfa/disable -
  alle self-scoped ueber actor.id, ohne @RequirePermission (siehe
  ALLOWLIST in authorization-coverage.e2e-spec.ts)
- AuthService.login() zweistufig: bei aktivem MFA erst
  { mfaRequired, mfaToken } statt Tokens, neuer Endpunkt
  POST /auth/mfa/verify schliesst den Flow ab
- Admin-Recovery: POST /users/:id/mfa/reset (users:update) fuer
  verlorene MFA-Geraete, da es keinen E-Mail-Reset-Flow gibt

Frontend:
- Login-Seite mit zweitem Schritt fuer den TOTP-Code
- Neue Profilseite (/profile, ausserhalb des admin-only
  Settings-Bereichs): Profilbild, Name/E-Mail, Passwort, MFA-Ein-/
  Ausrichtung mit QR-Code-Dialog
- Header zeigt jetzt Avatar mit Dropdown (Profil/Abmelden) statt
  nur E-Mail-Text
- Admin-Users-Tabelle zeigt MFA-Status + Reset-Button

Haertung nach Security-Review (Backend/Frontend-Diff, kein CRITICAL,
mehrere MEDIUM behoben):
- Access-Token wird bei Passwortwechsel sofort ungueltig
  (User.passwordChangedAt + JWT-iat-Vergleich in
  PermissionResolverService.isTokenValid, vorher isUserActive) statt
  erst nach bis zu 15 Minuten
- E-Mail-Aenderung verlangt jetzt aktuelles Passwort
- POST /profile/password und /profile/mfa/disable haben jetzt das
  gleiche strikte Throttling wie Login (SENSITIVE_ACTION_THROTTLE)
- Kein stiller leerer Verschluesselungs-Key-Fallback mehr (wirft
  jetzt explizit)

Bewusst zurueckgestellt (dokumentiert, kein aktiver Exploit-Pfad):
dedizierter Verschluesselungs-Key fuer MFA-Secrets statt
JWT_ACCESS_SECRET-Ableitung, dedizierte users:mfa-reset-Permission
statt users:update, separate JWT-Secrets pro Token-Zweck.

Verifiziert: tsc/eslint clean, 297/297 Backend- + 31/31
Frontend-Unit-Tests, Build clean auf beiden Projekten. e2e weiterhin
durch bekanntes WSL2/Postgres-Problem blockiert. Unabhaengiges
Security- und Code-Quality-Review durchgefuehrt (0 CRITICAL, 0 HIGH).

ApiCore-Backend/src/auth/auth.service.spec.ts

@@ -4,6 +4,7 @@ import { AuthService } from './auth.service';
 import { PrismaService } from '../prisma/prisma.service';
 import { UsersService } from '../users/users.service';
 import { AuditLogService } from '../audit/audit-log.service';
+import { MfaService } from './mfa/mfa.service';
 
 describe('AuthService', () => {
   let authService: AuthService;
@@ -19,16 +20,25 @@ describe('AuthService', () => {
   let jwtService: { sign: jest.Mock };
   let auditLog: { record: jest.Mock };
   let permissionResolver: { getPermissions: jest.Mock };
+  let mfaService: {
+    signChallengeToken: jest.Mock;
+    verifyChallengeToken: jest.Mock;
+    verifyCode: jest.Mock;
+  };
 
   const activeUser = {
     id: 'user-1',
     email: '[email protected]',
     isActive: true,
     passwordHash: '',
+    mfaEnabled: false,
+    mfaSecret: null as string | null,
   };
 
   beforeEach(async () => {
     activeUser.passwordHash = await bcrypt.hash('correct-password', 4);
+    activeUser.mfaEnabled = false;
+    activeUser.mfaSecret = null;
     usersService = { findByEmail: jest.fn(), findById: jest.fn() };
     prisma = {
       refreshToken: {
@@ -43,6 +53,11 @@ describe('AuthService', () => {
     permissionResolver = {
       getPermissions: jest.fn().mockResolvedValue(new Set()),
     };
+    mfaService = {
+      signChallengeToken: jest.fn().mockReturnValue('mfa-challenge-token'),
+      verifyChallengeToken: jest.fn(),
+      verifyCode: jest.fn(),
+    };
 
     authService = new AuthService(
       usersService as unknown as UsersService,
@@ -50,6 +65,7 @@ describe('AuthService', () => {
       jwtService as never,
       auditLog as unknown as AuditLogService,
       permissionResolver as never,
+      mfaService as unknown as MfaService,
     );
   });
 
@@ -87,6 +103,9 @@ describe('AuthService', () => {
         'correct-password',
       );
 
+      if (result.mfaRequired) {
+        throw new Error('expected mfaRequired to be false');
+      }
       expect(result.accessToken).toBe('signed.jwt.token');
       expect(result.refreshToken).toEqual(expect.any(String));
       const [[createArg]] = prisma.refreshToken.create.mock.calls as [
@@ -98,6 +117,29 @@ describe('AuthService', () => {
       );
     });
 
+    it('returns an MFA challenge instead of tokens when MFA is enabled', async () => {
+      usersService.findByEmail.mockResolvedValue({
+        ...activeUser,
+        mfaEnabled: true,
+        mfaSecret: 'encrypted-secret',
+      });
+
+      const result = await authService.login(
+        activeUser.email,
+        'correct-password',
+      );
+
+      if (!result.mfaRequired) {
+        throw new Error('expected mfaRequired to be true');
+      }
+      expect(result.mfaToken).toBe('mfa-challenge-token');
+      expect(mfaService.signChallengeToken).toHaveBeenCalledWith(activeUser.id);
+      expect(prisma.refreshToken.create).not.toHaveBeenCalled();
+      expect(auditLog.record).not.toHaveBeenCalledWith(
+        expect.objectContaining({ action: 'LOGIN' }),
+      );
+    });
+
     it('records a LOGIN_FAILED audit entry on wrong password', async () => {
       usersService.findByEmail.mockResolvedValue(activeUser);
       await expect(
@@ -126,6 +168,64 @@ describe('AuthService', () => {
     });
   });
 
+  describe('verifyMfaAndLogin', () => {
+    const mfaUser = {
+      ...activeUser,
+      mfaEnabled: true,
+      mfaSecret: 'encrypted-secret',
+    };
+
+    it('issues tokens and records LOGIN when the code is valid', async () => {
+      mfaService.verifyChallengeToken.mockReturnValue({ userId: mfaUser.id });
+      usersService.findById.mockResolvedValue(mfaUser);
+      mfaService.verifyCode.mockResolvedValue(true);
+      prisma.refreshToken.create.mockResolvedValue({});
+
+      const result = await authService.verifyMfaAndLogin(
+        'mfa-challenge-token',
+        '123456',
+      );
+
+      expect(result.accessToken).toBe('signed.jwt.token');
+      expect(mfaService.verifyCode).toHaveBeenCalledWith(
+        mfaUser.mfaSecret,
+        mfaUser.email,
+        '123456',
+      );
+      expect(auditLog.record).toHaveBeenCalledWith(
+        expect.objectContaining({ action: 'LOGIN', userId: mfaUser.id }),
+      );
+    });
+
+    it('throws and records LOGIN_FAILED when the code is invalid', async () => {
+      mfaService.verifyChallengeToken.mockReturnValue({ userId: mfaUser.id });
+      usersService.findById.mockResolvedValue(mfaUser);
+      mfaService.verifyCode.mockResolvedValue(false);
+
+      await expect(
+        authService.verifyMfaAndLogin('mfa-challenge-token', '000000'),
+      ).rejects.toBeInstanceOf(UnauthorizedException);
+      expect(auditLog.record).toHaveBeenCalledWith(
+        expect.objectContaining({
+          action: 'LOGIN_FAILED',
+          userId: mfaUser.id,
+        }),
+      );
+      expect(prisma.refreshToken.create).not.toHaveBeenCalled();
+    });
+
+    it('propagates an expired/invalid challenge token as UnauthorizedException', async () => {
+      mfaService.verifyChallengeToken.mockImplementation(() => {
+        throw new UnauthorizedException('expired');
+      });
+
+      await expect(
+        authService.verifyMfaAndLogin('bad-token', '123456'),
+      ).rejects.toBeInstanceOf(UnauthorizedException);
+      expect(usersService.findById).not.toHaveBeenCalled();
+    });
+  });
+
   describe('refresh', () => {
     it('throws when the refresh token is unknown', async () => {
       prisma.refreshToken.findUnique.mockResolvedValue(null);