fix(cluster0): wire 2FA redirects, heartbeat session touch, TOTP reset script

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/lab-seeds/backend/scripts/reset_user_totp.php

@@ -0,0 +1,38 @@
+#!/usr/bin/env php
+<?php
+/**
+ * Re-enroll TOTP for a user (lab / key rotation). Prints otpauth URI for Google Authenticator.
+ *
+ *   sudo php83 scripts/reset_user_totp.php admin
+ */
+declare(strict_types=1);
+
+require_once __DIR__ . '/../src/bootstrap.php';
+
+$username = trim($argv[1] ?? '');
+if ($username === '') {
+    fwrite(STDERR, "Usage: reset_user_totp.php <username>\n");
+    exit(1);
+}
+
+$st = Database::pdo()->prepare('SELECT id, username, email_normalized FROM users WHERE username = ? LIMIT 1');
+$st->execute([$username]);
+$row = $st->fetch(PDO::FETCH_ASSOC);
+if (!$row) {
+    fwrite(STDERR, "User not found: {$username}\n");
+    exit(1);
+}
+
+$uid = (int) $row['id'];
+$secret = AuthTotp::generateSecret();
+AuthFactors::enrollTotp($uid, $secret);
+
+$account = (string) ($row['email_normalized'] ?: $row['username']);
+$issuer = (string) cfg('app_name', 'AndroidCast');
+$uri = AuthTotp::provisioningUri($secret, $account, $issuer);
+$qr = AuthTotp::qrImageUrl($uri);
+
+echo "user={$username} id={$uid}\n";
+echo "otpauth_uri={$uri}\n";
+echo "qr_png={$qr}\n";
+echo "Scan the QR URL in a browser or add manually in Google Authenticator.\n";