fix(security): resolve user home dir for 2FA setup instructions

setup_user_2fa wrote each user's 2FA-setup instructions to the quoted
path "~$user/2fa-setup-instructions.txt". Tilde expansion does not occur
inside double quotes, so the path was treated literally and the write
failed with "No such file or directory", aborting the whole 2FA module
(and thus provisioning) under errexit.

Resolve the home directory explicitly with `getent passwd` and use that
absolute path for both the instructions file and the chown. Skip the
user cleanly if no home directory exists.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>

ProjectCode/Modules/Security/secharden-2fa.sh

@@ -240,7 +240,14 @@ function setup_user_2fa() {
     for user in "${users[@]}"; do
         if id "$user" &>/dev/null; then
             print_info "Setting up 2FA for user: $user"
-            
+
+            local user_home
+            user_home="$(getent passwd "$user" | cut -d: -f6)"
+            if [[ -z "$user_home" ]]; then
+                print_info "No home directory for $user, skipping"
+                continue
+            fi
+
             # Create 2FA setup script for user
             cat > "/tmp/setup-2fa-$user.sh" << 'EOF'
 #!/bin/bash
@@ -257,7 +264,7 @@ EOF
             chmod +x "/tmp/setup-2fa-$user.sh"
             
             # Instructions for user setup
-            cat > "~$user/2fa-setup-instructions.txt" << EOF
+            cat > "$user_home/2fa-setup-instructions.txt" << EOF
 TSYS Two-Factor Authentication Setup Instructions
 ==============================================
 
@@ -286,7 +293,7 @@ Without them, you may be locked out if you lose your phone.
 For support, contact your system administrator.
 EOF
             
-            chown "$user:$user" "~$user/2fa-setup-instructions.txt"
+            chown "$user:$user" "$user_home/2fa-setup-instructions.txt"
             print_info "2FA setup prepared for user: $user"
         else
             print_info "User $user not found, skipping"