feat(auth): harden authentication and add configurable two-factor support

app/Services/Auth/TwoFactorChallenge.php

@@ -8,6 +8,16 @@ use Illuminate\Http\Request;
 
 class TwoFactorChallenge
 {
+    /**
+     * Determine whether the user must enroll in two-factor authentication.
+     */
+    public function enrollmentRequiredFor(User $user): bool
+    {
+        return (bool) config('auth-ui.features.two_factor')
+            && (bool) config('auth-ui.features.two_factor_required')
+            && ! $user->hasEnabledTwoFactorAuthentication();
+    }
+
     /**
      * Determine whether the user must complete a two-factor challenge.
      */
@@ -25,6 +35,7 @@ class TwoFactorChallenge
         $request->session()->put([
             'login.id' => $user->getKey(),
             'login.remember' => $remember,
+            'login.started_at' => now()->timestamp,
         ]);
         $request->session()->regenerate();