fix: return 2FA users to account

[korone00]

Summary

• return regular users to the shared account page after two-factor enrollment
• keep the account route behind the mandatory enrollment gate
• verify TOTP, backup-code, enrollment, and setup re-entry flows against real account content

Root cause

The admin route split made /admin and /admin/account admin-only, but the two-factor setup redirects and disposable-user tests still targeted those paths. URL-only assertions could therefore accept a forbidden page as success.

Validation

• CLI lint and generated-file tests
• generated app Svelte check
• focused account and two-factor Playwright tests
• faithful isolated smoke: 34 passed, 3 environment-dependent tests skipped