fix(authentication): 2FA naming, backup codes gate, wire UserCreateByUsername gRPC

[kkopanidis]

SMS 2FA used inconsistent twoFaMethod values (phone vs sms), so enable/login flows could reject a valid method. Backup-code routes registered whenever the config object existed, ignoring enabled. UserCreateByUsername was declared in the proto but not registered on the gRPC service.

• Normalize SMS 2FA to twoFaMethod: 'sms' across enable, beginTwoFa, login challenge, and admin defaults; migrate legacy phone values on startup.
• Register /twoFa/generate and /twoFa/recover only when twoFa.backUpCodes.enabled is true.
• Wire userCreateByUsername on the authentication gRPC service map.

Test plan

• Enable SMS 2FA and run beginTwoFa — no "Invalid method" error
• Full login with SMS 2FA (local → authorize → verify)
• With twoFa.backUpCodes.enabled: false, backup routes are not registered
• gRPC UserCreateByUsername creates a user

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update
• Refactor
• Build-related changes
• Other (please describe)

Does this PR introduce a breaking change?

• Yes
• No

The PR fulfills these requirements:

• It's submitted to the main branch
• When resolving a specific issue, it's referenced in the PR's description (e.g. fix #xxx, where "xxx" is the issue number)

If adding a new feature, the PR's description includes:

• A convincing reason for adding this feature

Other information: