v1.24.0

feat: standard TOTP 2FA auto-override strategy (#72)

* feat: implement standard TOTP 2FA auto-override strategy

* docs: add TOTP 2FA configuration guide and security risk disclosures

* fix: add comments to unused exports to satisfy knip/documentation checks

* fix: sync package-lock.json with otpauth dependency

The otpauth dependency was added to package.json but package-lock.json
was not updated, causing `npm ci` to fail in CI (test + knip jobs).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* refactor: harden TOTP auto-override and add selector override env vars

- Extract TOTP handling into TotpChallengeHandler (src/totp-strategy.ts):
  at most one submission per TOTP window and 2 per login attempt, failing
  with AUTH_FAILED instead of retrying until IBKR locks the account
- Pass 2FA strategy/secret through HeadlessAuthConfig instead of importing
  global config; consolidate the duplicated authConfig construction in
  tool-handlers into buildHeadlessAuthConfig()
- Drop the overly broad input[type=text]/bare button fallback selectors and
  add IB_SELECTOR_* env vars to override login and TOTP form selectors
- Rewrite the TOTP test to exercise the real handler (exact token, window
  buffering, per-window dedupe, attempt cap, selector overrides)
- Declare engines >=20.19.0 (required by otpauth's @noble/hashes dependency)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>