This PR implements Time-Based One-Time Password (TOTP) 2FA for FileBrowser, enhancing user security by requiring a verification code during login for users with 2FA enabled. It addresses multiple community requests for 2FA support.

Closes #286
Closes #1674
Closes #1827
Closes #2504
Closes #3371
Closes #3800

Description

The TOTP 2FA feature allows users to enable 2FA in their profile settings, scan a QR code or enter a Base32-encoded secret in an authenticator app (e.g., Google Authenticator), and verify codes at login. The flow is:

1. Enable 2FA in Settings > Profile > 2FA section by entering the password and receiving a QR code or secret.
2. Add the secret to an authenticator app.
3. Verify a TOTP code to activate 2FA.
4. On subsequent logins, enter a TOTP code after the password if 2FA is enabled.

Further comments

2FA could be handled by reverse proxies like oauth2-proxy or authelia, but this feature simplifies setup without requiring nginx/Apache knowledge.

New options

• To enable TOTP, you must configure a 32-byte encryption key in your configuration file.
  Generate a cryptographically secure 32-byte Base64-encoded key with this command:

  openssl rand -base64 32

  {
    "totp": {
      "encryption": {
        "key": "<32-byte-base64-encoded-string>"
       }
    }
  }

• The TOTP token expiration (default: 2 minutes) defines the validity window after initial authentication. Configure this via:

  • totp-token-expiration-time option in cli
  • totp > token > expiration > time in config file

New dependencies

• pquerna/otp on the back-end for TOTP handling
• @scure/base on the front-end for base32 encoding of TOTP secret

Localization

Added phrases to en.json but not other languages. Seek community help to translate phrases.

Improvements

1. Add rate limiting to /api/users/{id}/otp/check to prevent brute-force attacks.
2. Implement backup codes for when the authenticator device is unavailable.
3. Allow users to configure which routes require 2FA.

Documentation

While reviewing the documentation, I identified areas for improvement. Could you guide me to the documentation source (e.g., wiki repository) so I may submit updates?

🚨 Before submitting your PR, please indicate which issues are either fixed or closed by this PR. See GitHub Help: Closing issues using keywords.

• DO make sure you are requesting to pull a topic/feature/bugfix branch (right side). Don't request your master!
• DO make sure you are making a pull request against the master branch (left side). Also you should start your branch off our master.
• DO make sure that File Browser can be successfully built. See builds and development.
• AVOID breaking the continuous integration build.