Security Tools Release (main)

docs: the wiki still said Libre OTP was "enforced through PAM"

The README was corrected for this months ago; the wiki was not. It told readers
the tool is enforced through PAM, which would send them to add
`pam_libre_otp.so` to their SSH auth stack — a module that does not exist,
referencing which can lock them out of the machine. The correction says what was
wrong and what to remove, rather than quietly editing the sentence, because
someone may have acted on it.

It now describes what the tool actually does, including two things that were
implemented but never explained:

**The prompt shows a code and asks for one.** That reads like redundancy and is
not. An ordinary 2FA prompt proves only that *you* hold the secret; it says
nothing about the machine, so a convincing fake prompt harvests a code and you
learn nothing. Showing the code first inverts that — if the number on screen does
not match your authenticator, the thing asking does not hold the secret and you
should not answer it. Worth knowing before setting the display mode to `none`.

**`--double-check` wants two consecutive codes**, so a single shoulder-surfed
code is not enough on its own.

Also adds the authenticator-app guidance the user asked for: Aegis or FreeOTP,
offline and open source. An authenticator that syncs seeds to a vendor's cloud
makes the second factor only as strong as that vendor and their willingness to
refuse a request for the seed — which is most of what a second factor exists to
remove.

The scarecrow entry now documents the three duress PINs with the real flags, the
requirement to name a device before anything can be erased, the header-backup
advice, and the note that all three are verified every attempt so the timing does
not reveal which matched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>