Adds dedicated unit and integration tests for the at-rest hardening so
each piece of the new behaviour is exercised explicitly:

internal/crypto/otp_test.go (new)
- HashOTP round-trip with the original plaintext
- VerifyOTPHash rejects: wrong plaintext, wrong server key, mismatched
  digest length
- VerifyOTPHash MUST reject the stored digest itself when used as input
  (otherwise the digest is a replayable credential)
- HashOTP is deterministic for a fixed (plaintext, key) pair

internal/crypto/totp_test.go (new)
- EncryptTOTPSecret produces enc:v1: ciphertext that decrypts to the
  original plaintext
- AES-GCM nonce randomness — same input yields different ciphertext
- DecryptTOTPSecret transparently passes through legacy plaintext rows
- DecryptTOTPSecret detects tampered ciphertext (GCM authentication)
- DecryptTOTPSecret fails on the wrong key
- EncryptTOTPSecret on empty input is a no-op
- IsEncryptedTOTPSecret prefix detection

internal/integration_tests/totp_at_rest_test.go (new)
- Generate() writes the secret as enc:v1:<ciphertext>, never as the raw
  base32 string. Decrypted value matches the plaintext returned to the
  caller for QR rendering.
- Validate() accepts a code computed from the encrypted secret.
- Validate() lazy-migrates a legacy plaintext row: a row written without
  the enc:v1: prefix still validates, AND the row is rewritten into the
  enc:v1: form on the first successful Validate.
- Validate() rejects an obviously wrong code on an encrypted row.
- Validate() is idempotent on already-encrypted rows: the underlying
  plaintext does not change across multiple validations.

internal/integration_tests/{verify_otp,resend_otp,reset_password}_test.go
- Reworked to seed a known plaintext / digest pair via UpsertOTP and
  verify with the plaintext, instead of reading the stored digest back
  out of the database and replaying it. The previous flow only passed
  because of the legacy plaintext fallback (see below).
- Added new "should fail when stored hash is replayed as input"
  subtest to lock the security guarantee in.

internal/integration_tests/test_helper.go
- Expose Config and AuthenticatorProvider on testSetup so tests can
  access cfg.JWTSecret and the totp authenticator. Config was already
  in the struct but never assigned by initTestSetup; this fixes that
  oversight.

internal/graphql/verify_otp.go and reset_password.go
- Drop the legacy plaintext fallback in the OTP comparison. The
  fallback was originally added to keep in-flight OTPs verifying during
  a rolling upgrade, but it ALSO accepted the stored digest itself as
  valid input — turning the digest into a replayable credential for
  anyone with DB read access. OTPs expire in minutes so the rolling-
  upgrade window is naturally bounded; users on either side simply
  request a fresh code.

…n Validate

Replaces the --enable-totp-migration flag with an in-Validate
branch that handles both forms in one place. The migration is now
always-on and the storage helper is no longer permitted to silently
pass legacy values through.

Why
---
The flag-gated lazy migration was over-engineered for the typical
deploy model. It existed to protect rolling deploys across multiple
replicas, but the protection was conditional: operators had to remember
to flip the flag at the right time, and the implicit "DecryptTOTPSecret
returns plaintext for legacy rows" behaviour was easy to miss when
reading the code.

The new shape is closer to the obvious algorithm: decrypt if you can,
fall back to the raw value if you can't, migrate if the fallback
matched.

Changes
-------

internal/crypto/totp.go
- DecryptTOTPSecret is now strict: it returns the new sentinel
  ErrTOTPSecretNotEncrypted on a non-prefixed row instead of silently
  echoing the input. The "decrypt" function now does exactly one thing,
  which is much easier to reason about.
- Test updated to assert the sentinel error.

internal/authenticators/totp/totp.go::Validate
- Branches explicitly on the decrypt result. Three outcomes:
    decErr == nil                              → enc:v1: row, use plaintext
    errors.Is(decErr, ErrTOTPSecretNotEncrypted) → legacy row, use raw value, migrate
    other decErr                               → fail closed, log loudly
- Migration is always attempted on a successful legacy validation; the
  write is best-effort (failures logged, login still succeeds).
- The function comment now documents the rolling-deploy tradeoff
  explicitly so operators with multi-replica clusters can plan around
  it (atomic deploy preferred; brief maintenance window otherwise).

internal/authenticators/totp/provider.go
internal/authenticators/providers.go
internal/config/config.go
cmd/root.go
- Drop EnableLazyMigration / Config.EnableTOTPMigration / the
  --enable-totp-migration CLI flag. There is no operator-facing knob
  any more.

internal/integration_tests/totp_at_rest_test.go
- Drop the "without migration" subtest (the flag it tested no longer
  exists).
- The "lazy migration" subtest is unchanged structurally but now
  exercises the always-on path.

Concurrency, write semantics, and idempotency are unchanged from the
previous commit:
- Two replicas migrating the same row write semantically identical
  plaintexts under different AES-GCM nonces; last writer wins; the
  IsEncryptedTOTPSecret short-circuit prevents re-encryption.
- A failed migration write does NOT fail the login.
- A decrypt failure on a prefixed row (e.g. wrong --jwt-secret) is
  fail-closed.

Known tradeoff
--------------
For a rolling deploy from a pre-encryption release: as soon as one
replica handles a TOTP login, that user's row is in enc:v1: form. Any
old replica that subsequently reads the row will treat the prefix as
part of a base32 secret and fail. Either deploy atomically, or accept
a short window during which migrated users may be locked out of old
replicas (TOTP codes regenerate every 30s so the user-visible impact
is bounded).