feat(security): add two-factor authentication role

Port Modules/Security/secharden-2fa.sh.

Configures TOTP two-factor authentication via Google Authenticator for:
- SSH (publickey + keyboard-interactive)
- Cockpit web interface (PAM with Google Authenticator)
- Webmin (if installed, TOTP provider enabled)

Includes:
- Backup of existing SSH, PAM, and Cockpit configs before changes
- PAM sshd and cockpit config deployment
- Per-user enrollment scaffolding (setup script + instructions for
  root and localuser)
- SSH service validation before restart

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

roles/security_2fa/files/cockpit.conf

@@ -0,0 +1,10 @@
+[WebService]
+# Enable 2FA for Cockpit web interface
+LoginTitle = TSYS Server Management
+LoginTo = 300
+RequireHost = true
+
+[Session]
+# Use PAM for authentication (includes 2FA)
+Banner = /etc/cockpit/issue.cockpit
+IdleTimeout = 15