fix(security): actually set Webmin 2FA directives in miniserv.conf

configure_webmin_2fa used `sed -i ... || echo ... >>` to add
twofactor_provider and twofactor to /etc/webmin/miniserv.conf. sed
returns 0 even when it matches nothing, so when the directives were
absent (the normal case on a fresh Webmin install) the `|| echo` branch
never ran. The script printed "Webmin 2FA configuration completed" while
leaving 2FA entirely unconfigured — caught by 2fa-validation reporting
"Webmin TOTP provider not configured".

Guard each directive with grep so it is appended when absent and updated
when present.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

ProjectCode/Modules/Security/secharden-2fa.sh

@@ -219,13 +219,21 @@ function configure_webmin_2fa() {
         # Stop webmin service
         systemctl stop webmin || true
         
-        # Enable 2FA in Webmin configuration
-        sed -i 's/^twofactor_provider=.*/twofactor_provider=totp/' "$webmin_config" || \
-        echo "twofactor_provider=totp" >> "$webmin_config"
+        # Enable 2FA in Webmin configuration. `sed -i ... || echo` would never
+        # append, because sed returns 0 even when it matches nothing; guard with
+        # grep so the directive is added when absent and updated when present.
+        if grep -q '^twofactor_provider=' "$webmin_config"; then
+            sed -i 's/^twofactor_provider=.*/twofactor_provider=totp/' "$webmin_config"
+        else
+            echo "twofactor_provider=totp" >> "$webmin_config"
+        fi
 
         # Enable 2FA requirement
-        sed -i 's/^twofactor=.*/twofactor=1/' "$webmin_config" || \
-        echo "twofactor=1" >> "$webmin_config"
+        if grep -q '^twofactor=' "$webmin_config"; then
+            sed -i 's/^twofactor=.*/twofactor=1/' "$webmin_config"
+        else
+            echo "twofactor=1" >> "$webmin_config"
+        fi
         
         # Start webmin service
         systemctl start webmin || true