fix(api): scope TOTP oversight to the caller's workspace

The second-factor listing was instance-wide and the three mutating endpoints never checked that the target Account belongs to the caller's Workspace, so an owner or admin could see and reset another tenant's account. The listing now resolves the Workspace members and the mutations answer 404 for a foreign account, which does not disclose that it exists.

Also fixes the TOTP write path on Postgres: six write points passed timezone-aware datetimes into timestamp-without-time-zone columns, which asyncpg rejects, so every enroll, confirm, revoke and recovery-code consumption raised a 500 there. SQLite tolerated the same values.

The panel derives its oversight view from the API authorization instead of the length of the account list, which would have hidden it in a single-member Workspace.

web/src/app/home/components/account-settings-dialog/AccountSettingsPanel.tsx

@@ -131,9 +131,11 @@ export default function AccountSettingsPanel({
   async function loadTotpAccounts() {
     try {
       const res = await httpClient.getTotpAccounts();
-      const list = res.accounts || [];
-      setIsManager(list.length > 1);
-      setTotpRows(list);
+      // The role rule lives in the API: owners and admins receive the Workspace
+      // list, everyone else receives 403. Deriving manager state from the list
+      // length would hide oversight in a single-member Workspace.
+      setIsManager(true);
+      setTotpRows(res.accounts || []);
     } catch {
       // A non-manager receives 403 here; the panel keeps working on own state.
       setIsManager(false);

web/src/i18n/locales/en-US.ts

@@ -2316,7 +2316,7 @@ const enUS = {
     totpStatusDisabled: 'Not enabled',
     totpCodesRemaining: '{{count}} recovery codes left',
     totpManagerSectionDesc:
-      'Owners and admins can review and revoke the second factor of any Account.',
+      'Owners and admins can review and revoke the second factor of Accounts in this Workspace.',
     revokeTotp: 'Re-bind',
     totpAdminResetTitle: 'Re-bind two-factor authentication for {{user}}',
     totpAdminResetDesc:

web/src/i18n/locales/es-ES.ts

@@ -2367,7 +2367,7 @@ const esES = {
     totpStatusDisabled: 'No activada',
     totpCodesRemaining: 'Quedan {{count}} códigos de recuperación',
     totpManagerSectionDesc:
-      'Los propietarios y administradores pueden revisar y restablecer el segundo factor de cualquier cuenta.',
+      'Los propietarios y administradores pueden revisar y restablecer el segundo factor de las cuentas de este espacio de trabajo.',
     revokeTotp: 'Reasignar',
     totpAdminResetTitle: 'Reasignar la verificación en dos pasos de {{user}}',
     totpAdminResetDesc:

web/src/i18n/locales/ja-JP.ts

@@ -2331,7 +2331,7 @@ const jaJP = {
     totpStatusDisabled: '未設定',
     totpCodesRemaining: 'リカバリーコード残り {{count}} 個',
     totpManagerSectionDesc:
-      'オーナーと管理者はすべてのアカウントの二段階認証を確認・解除できます。',
+      'オーナーと管理者はこのワークスペースのアカウントの二段階認証を確認・解除できます。',
     revokeTotp: '再バインド',
     totpAdminResetTitle: '{{user}} の二段階認証を再バインド',
     totpAdminResetDesc:

web/src/i18n/locales/ru-RU.ts

@@ -2339,7 +2339,7 @@ const ruRU = {
     totpStatusDisabled: 'Не включено',
     totpCodesRemaining: 'Осталось кодов восстановления: {{count}}',
     totpManagerSectionDesc:
-      'Владельцы и администраторы могут просматривать и сбрасывать второй фактор любого аккаунта.',
+      'Владельцы и администраторы могут просматривать и сбрасывать второй фактор аккаунтов этого рабочего пространства.',
     revokeTotp: 'Перепривязать',
     totpAdminResetTitle:
       'Перепривязать двухфакторную аутентификацию для {{user}}',

web/src/i18n/locales/th-TH.ts

@@ -2268,7 +2268,7 @@ const thTH = {
     totpStatusDisabled: 'ยังไม่เปิดใช้',
     totpCodesRemaining: 'เหลือรหัสกู้คืน {{count}} รหัส',
     totpManagerSectionDesc:
-      'เจ้าของและผู้ดูแลสามารถตรวจสอบและรีเซ็ตการยืนยันสองขั้นตอนของบัญชีใดก็ได้',
+      'เจ้าของและผู้ดูแลสามารถตรวจสอบและรีเซ็ตการยืนยันสองขั้นตอนของบัญชีในพื้นที่ทำงานนี้',
     revokeTotp: 'ผูกใหม่',
     totpAdminResetTitle: 'ผูกการยืนยันสองขั้นตอนใหม่ให้ {{user}}',
     totpAdminResetDesc:

web/src/i18n/locales/vi-VN.ts

@@ -2302,7 +2302,7 @@ const viVN = {
     totpStatusDisabled: 'Chưa bật',
     totpCodesRemaining: 'Còn {{count}} mã khôi phục',
     totpManagerSectionDesc:
-      'Chủ sở hữu và quản trị viên có thể xem và đặt lại yếu tố thứ hai của bất kỳ tài khoản nào.',
+      'Chủ sở hữu và quản trị viên có thể xem và đặt lại yếu tố thứ hai của các tài khoản trong không gian làm việc này.',
     revokeTotp: 'Liên kết lại',
     totpAdminResetTitle: 'Liên kết lại xác thực hai bước cho {{user}}',
     totpAdminResetDesc:

web/src/i18n/locales/zh-Hans.ts

@@ -2175,7 +2175,7 @@ const zhHans = {
     totpRecoveryCodesRegenerated: '已生成新的恢复代码',
     totpStatusDisabled: '未启用',
     totpCodesRemaining: '剩余 {{count}} 个恢复代码',
-    totpManagerSectionDesc: '所有者和管理员可以查看并重置任意账户的两步验证。',
+    totpManagerSectionDesc: '所有者和管理员可以查看并重置本工作区账户的两步验证。',
     revokeTotp: '重新绑定',
     totpAdminResetTitle: '重新绑定 {{user}} 的两步验证',
     totpAdminResetDesc:

web/src/i18n/locales/zh-Hant.ts

@@ -2172,7 +2172,7 @@ const zhHant = {
     totpRecoveryCodesRegenerated: '已產生新的恢復代碼',
     totpStatusDisabled: '未啟用',
     totpCodesRemaining: '剩餘 {{count}} 個恢復代碼',
-    totpManagerSectionDesc: '擁有者與管理員可以檢視並重設任意帳號的兩步驗證。',
+    totpManagerSectionDesc: '擁有者與管理員可以檢視並重設本工作區帳號的兩步驗證。',
     revokeTotp: '重新綁定',
     totpAdminResetTitle: '重新綁定 {{user}} 的兩步驗證',
     totpAdminResetDesc: