Hertis Ops

Two-factor is not enrolled. Set ADMIN_TOTP_SECRET to require an authenticator code — see docs/SECURITY_POSTURE.md.