Enrol or replace the authenticator app

Issues a new TOTP secret and its QR. First enrolment needs no body but may not be reached with the `pending_2fa` token (the e-mailed code comes first). Replacing a PROVEN device needs `auth_code` from it. Same contract as `POST /api/v1/auth/authenticator`.

curl -X POST "https://example.com/api/v2/auth/authenticator" \  -H "Content-Type: application/json" \  -d '{}'