TOTP-based 2FA management