feat(security): add two-factor authentication role

Port Modules/Security/secharden-2fa.sh.

Configures TOTP two-factor authentication via Google Authenticator for:
- SSH (publickey + keyboard-interactive)
- Cockpit web interface (PAM with Google Authenticator)
- Webmin (if installed, TOTP provider enabled)

Includes:
- Backup of existing SSH, PAM, and Cockpit configs before changes
- PAM sshd and cockpit config deployment
- Per-user enrollment scaffolding (setup script + instructions for
  root and localuser)
- SSH service validation before restart

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

roles/security_2fa/files/2fa-setup-instructions.txt

@@ -0,0 +1,26 @@
+TSYS Two-Factor Authentication Setup Instructions
+==============================================
+
+Your system has been configured for 2FA. To complete setup:
+
+1. Install an authenticator app on your phone:
+   - Google Authenticator
+   - Authy
+   - Microsoft Authenticator
+
+2. Run the setup command:
+   sudo /tmp/setup-2fa.sh
+
+3. Follow the prompts:
+   - Scan the QR code with your app
+   - Save the backup codes securely
+   - Answer 'y' to security questions
+
+4. Test your setup:
+   - SSH to the server
+   - Enter your 6-digit code when prompted
+
+IMPORTANT: Save backup codes in a secure location!
+Without them, you may be locked out if you lose your phone.
+
+For support, contact your system administrator.