How to add TOTP-based two-factor authentication to a Next.js SaaS with Drizzle ORM -- generating secrets, rendering QR codes, validating codes at login, and issuing backup codes so users never get locked out.