various two factor auth improvements

(not to be merged yet)

* [x] implement TOTP checking in postgres
* [ ] move two factor auth verification to postgres
* [ ] remove the frontend's direct access to read TOTP secrets, but still let it set them
* [ ] require 2fa at the database level for protected actions like login, withdrawal and turning off 2fa
* [ ] make one time use codes in case of lost TOTP secrets
It returns null if the user is not found, but yeah, making it throw instead is probably better. I'll use `strict`.