Add MFA to the site

[cguess]

Depends on #7

[github-actions]

Stale issue message

[reefdog]

Googled around a bit, surfacing a few projects to look at:

• https://github.com/wmlele/devise-otp: Small project but actively-maintained and with current Rails compatibility.
• https://github.com/tinfoil/devise-two-factor: Larger project that may or may not work well; seems to leave more of the interface up to the user (which could be good). Also the basis for this potentially-useful tutorial.
• https://github.com/Houdini/two_factor_authentication: Stale project (see this issue), but seemed to have been quite popular, so may be a good starting point for "alternatives to…" searches.
• https://github.com/baarkerlounger/two_factor_authentication: Lightly modernized version of the above gem that actually works.

[cguess]

In a discussion with @reefdog we've decided to go full webauthn. Luckily there's a write up here https://www.honeybadger.io/blog/multi-factor-2fa-authentication-rails-webauthn-devise/ to do so