fix: 2FA security and GDPR compliance issues

[Mimah97]

Summary

Fixes four critical security and compliance issues in 2FA setup, backup code management, and GDPR consent tracking.

Changes

#688 — TwoFactorSettings race condition on page load

• Added tokens?.accessToken to effect dependency array so status fetch retries once token hydrates
• Added loading state instead of showing incorrect "Disabled" default during initial render

#690 — TwoFactorSetup backup code acknowledgment

• Added checkbox requirement ("I have saved my backup codes") before "Enable 2FA" becomes clickable
• Prevents users from completing setup without acknowledging backup codes

#689 — Backup code regeneration authentication

• Modified generateBackupCodes API to accept TOTP token verification
• Added confirmation dialog stating existing codes will be invalidated
• Requires fresh TOTP entry before generation in both TwoFactorRecovery and TwoFactorSettings components
• Prevents stolen tokens from silently regenerating backup codes as a 2FA bypass

#691 — GDPR consent timestamp accuracy

• Now sources consent timestamp from server preferences instead of localStorage
• Only updates timestamp on false→true transition of dataShareConsent, not on every save
• Ensures consent timestamp reflects actual consent event, not last unrelated settings update
• Consistent across devices/browsers

Closes #688, Closes #690, Closes #689, Closes #691

[drips-wave]

@Mimah97 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[orbitlumen-hue]

resolve conflicts