feat(auth): harden authentication and add configurable two-factor support

app/Models/User.php

@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Notifications\QueuedResetPasswordNotification;
 use Database\Factories\UserFactory;
 use Illuminate\Contracts\Auth\MustVerifyEmail;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -61,6 +62,7 @@ class User extends Authenticatable implements MustVerifyEmail
             'email_verified_at' => 'datetime',
             'password' => 'hashed',
             'two_factor_confirmed_at' => 'datetime',
+            'auth_session_version' => 'integer',
         ];
     }
 
@@ -82,6 +84,15 @@ class User extends Authenticatable implements MustVerifyEmail
         return $this->password !== null;
     }
 
+    /**
+     * Queue password reset mail so the request does not reveal account
+     * existence through mail-delivery timing.
+     */
+    public function sendPasswordResetNotification($token): void
+    {
+        $this->notify(new QueuedResetPasswordNotification($token));
+    }
+
     /**
      * Get the user's social accounts.
      */