fix(security): harden 2FA setup, OIDC default role, and rate-limit fallback (v0.17.3-beta)

Address the actionable findings from an adversarial review:

- 2FA enrollment now requires the current password (/totp/setup), so a
  hijacked session or XSS can't enable TOTP and lock the real user out.
  SSO-only accounts (no local password) are told to set one first. Frontend
  collects the password before starting setup.
- OIDC config rejects default_role='admin': auto-provisioning unmatched users
  straight to admin is almost never intended — admin must come from an explicit
  group → role mapping.
- Rate limiter no longer fails fully open on a Redis outage. Redis calls are
  bounded by an 800ms timeout (the client uses maxRetriesPerRequest:null, so
  commands would otherwise hang, not throw), and on failure a per-process
  in-memory sliding-window fallback keeps /login and other limited endpoints
  throttled. Verified with Redis stopped: attempts throttle (429) instead of
  hanging or passing unlimited.

Findings intentionally not actioned: the "API-token auth is fire-and-forget"
report was a false positive (Express awaits next(), which is called inside the
promise), and the webhook DB-pool and JWT-revocation items are either
overstated or a separate architectural decision.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/services/api.ts

@@ -54,8 +54,8 @@ export const authApi = {
     ),
   totpVerify: (totp_token: string, code: string) =>
     api.post<{ token: string; user: import('../types').User }>('/auth/totp/verify', { totp_token, code }),
-  totpSetup: () =>
-    api.post<{ secret: string; uri: string; qr: string }>('/auth/totp/setup'),
+  totpSetup: (password: string) =>
+    api.post<{ secret: string; uri: string; qr: string }>('/auth/totp/setup', { password }),
   totpConfirm: (code: string) =>
     api.post<{ ok: boolean }>('/auth/totp/confirm', { code }),
   totpDisable: (password: string) =>