Turn on sign-in codes from an authenticator app

Takes the key from startTotpSetup and a current code from the app. From then on every sign-in asks for a code from the app.

curl -X PUT "https://example.com/api/me/security/totp" \  -H "Content-Type: application/json" \  -d '{    "secret": "string",    "code": "string"  }'

{  "ok": true}