OTP/SMS/email for step-up on multi-device/web

Not all users have biometric hardware — older laptops, shared workstations, and most desktop web browsers lack TouchID or FaceID. If biometric is the only step-up path on multi-device or web contexts, users without capable hardware are either blocked from completing financial operations or silently bypassed by the application. CWE-308 (Use of Single-Factor Authentication) applies when a required step-up factor is unavailable to a meaningful portion of users. PCI-DSS Req 8.4 requires that multi-factor authentication be available for all applicable users. At least two fallback methods — OTP-SMS, OTP-email, or TOTP — ensures step-up is universally enforced rather than selectively applied based on hardware.

Add OTP and TOTP fallback paths in src/lib/stepUpAuth.ts for multi-device and web contexts:

export async function performMultiDeviceStepUp(
  email: string,
  phone: string
): Promise<boolean> {
  const method = await promptStepUpMethod(
    ['otp-sms', 'otp-email', 'totp-app']
  );
  if (method === 'otp-sms') {
    const otp = generateOTP();
    await sendSMS(phone, `Your verification code: ${otp}`);
    return verifyOTP(otp);
  }
  if (method === 'otp-email') {
    const otp = generateOTP();
    await sendEmail(email, `Your verification code: ${otp}`);
    return verifyOTP(otp);
  }
  if (method === 'totp-app') {
    return verifyTOTP(); // TOTP authenticator app
  }
  return false;
}

Expose at minimum two of the three methods so a user without a phone can use email OTP, and a user without email access can use a TOTP app.