How TOTP, QR codes, and backup codes work—and how SecureTools implements RFC 6238 locally with otplib.