feat(auth): harden authentication and add configurable two-factor support

app/Http/Controllers/Auth/TwoFactorSetupController.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Models\User;
+use App\Services\Auth\TwoFactorEnrollmentState;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class TwoFactorSetupController extends Controller
+{
+    /**
+     * Display the mandatory two-factor enrollment flow.
+     */
+    public function __invoke(
+        Request $request,
+        TwoFactorEnrollmentState $enrollmentState
+    ): Response|RedirectResponse {
+        abort_unless(
+            config('auth-ui.features.two_factor')
+            && config('auth-ui.features.two_factor_required'),
+            404
+        );
+
+        /** @var User $user */
+        $user = $request->user();
+
+        if ($user->hasEnabledTwoFactorAuthentication()
+            && ! $request->session()->has('recoveryCodes')) {
+            return redirect()->intended(config('auth-ui.redirects.login', '/'));
+        }
+
+        return Inertia::render('Auth/TwoFactorSetup', [
+            'twoFactor' => $enrollmentState->for($user),
+        ]);
+    }
+
+    /**
+     * Continue to the page that was requested before enrollment.
+     */
+    public function complete(Request $request): RedirectResponse
+    {
+        abort_unless(
+            config('auth-ui.features.two_factor')
+            && $request->user()?->hasEnabledTwoFactorAuthentication(),
+            404
+        );
+
+        return redirect()->intended(config('auth-ui.redirects.login', '/'));
+    }
+}