feat(crypto): TOTP and recovery codes

ADR 0017's second factor, in halkyon_base_server (base.dart):
- RFC 6238 with HMAC-SHA1, 6 digits, 30-second steps, one step either
  way. checkTotp takes the account's last accepted step as a required
  argument and refuses a code of that step or before, so no code is
  accepted twice; every step of the window is computed and compared.
- 160-bit secrets in RFC 4648 Base32 (strict decoding); the otpauth
  URI with issuer and account escaped.
- Ten recovery codes of eight Crockford characters (short_code.dart),
  kept as SHA-256 hashes, each used once, every hash compared in
  constant time.
- Tests: RFC 6238 Appendix B (8 digits, SHA-1, SHA-256, SHA-512), the
  window, replay, RFC 4648's Base32 vectors, the recovery codes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/lib/base.dart

@@ -2,7 +2,8 @@
 /// (`HalkyonBase.configure`), how people authenticate, the account's
 /// deletion and the pruning, email sign-in's helpers, the instance's
 /// basics, people's public profiles and their pages, the instance's register
-/// (ADR 0016), SRP's register side (ADR 0017), and the module's models.
+/// (ADR 0016), SRP's register side, TOTP and recovery codes (ADR 0017), and
+/// the module's models.
 library;
 
 export 'src/auth/account.dart';
@@ -47,3 +48,6 @@ export 'src/srp/srp_server.dart'
         SrpVerification,
         srpChallenge,
         srpVerify;
+export 'src/totp/base32.dart';
+export 'src/totp/recovery_codes.dart';
+export 'src/totp/totp.dart';