billy-weld Admin

Phase C wires the real login handler + TOTP + recovery flow.