enableTwoFactor returns a data-URL QR via uqr; starters show an img so
the otpauth secret never leaves the process.

Co-authored-by: Cursor <cursoragent@cursor.com>