Clarify API key scopes, and site-wide 2FA policy

[TerryCavanagh]

I have two factor authentication on my itch.io account, but right now I can log into the itch app and access all my games without it!

[fasterthanlime]

Known issue, thanks for reporting it here

Note that you do need 2FA to purchase (from the app) a game linked to your account. API keys give mostly read-only access. Needs to be part of a bigger discussion with @leafo

[fasterthanlime]

So! The situation was already handled in v23, but in v25 the 2FA dialog is prettier.

• Logging into the app now requires entering a two-factor code (if you have 2FA enabled)
• ..and it sets a cookie for that profile, logging you into the website.

Calling it done.