feat(2fa): audit second-factor events and notify the account owner

[FrankApiyo]

Changes / Features implemented

Second-factor lifecycle events now leave a trace. Confirming an enrolment writes a two-factor-enrolled entry to the security audit log, and a failed code check — on verify or on any code-guarded action — writes two-factor-verification-failed. Enrolling and disabling both email the account owner, so whoever made the change, the owner finds out. Notification templates follow the account-lockout ones.

Steps taken to verify this change does what is intended

Adopted the four tests from the outstanding-security-issues review, which were run and failing against this branch before the change. Template rendering verified locally through get_two_factor_email_data.

Side effects of implementing this change

None on API responses — audit entries and emails are added after the existing transactions commit, and the email is skipped for accounts with no address.

Before submitting this PR for review, please make sure you have:

• Included tests
• Updated documentation

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[FrankApiyo]

Merged into feat/step-up-authentication via d76deac (carried by #3215), so this standalone PR is no longer needed.