feat: add TOTP 2FA, API key switcher, login progress bar, and alpha hardening plan

- TOTP 2FA: full setup/confirm/disable/login flow with Argon2id + ChaCha20-Poly1305
  encrypted secret storage, QR code generation, and bcrypt-hashed backup codes
- API key switcher: OAuth vs personal API key toggle in AIUI chat settings with
  status indicator, key validation, and help text
- Login progress bar: server startup detection with health check polling, form
  disabled until server is ready
- AI quarantine docs: comprehensive HTML page documenting all 6 security layers
- Settings: AI Data Access permission toggles with per-category control
- Alpha hardening plan: 28-task overnight automation plan across 7 phases
  (onboarding, login, app install, AIUI, UI polish, security, ISO build)
- Backlog: node discovery spatial map feature for alpha demo

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

BACKLOG.md

@@ -0,0 +1,34 @@
+# Archipelago Backlog
+
+## Node Discovery & Spatial Map (Alpha Demo Feature)
+
+**Priority:** High (needed for live alpha demo)
+
+### "Find Nodes" — Spatial Node Discovery
+
+Add a "Find Nodes" button to the Messages tab that opens a modal with an interactive spatial node map.
+
+**Requirements:**
+- Visual spatial map showing discovered Archipelago nodes
+- Each node displays its self-chosen name (pseudonym)
+- Connection request flow: discover → request → peer approves → connected
+- Optional locality broadcasting (toggle: share general area or stay anonymous)
+- Cool, visual, presentation-worthy UI for live alpha demo
+
+**Onboarding Addition:**
+- Add "Name your node" step during setup/onboarding
+- Include privacy guidance: "Use a pseudonym if you want privacy"
+- Node name is broadcast on the discovery network
+
+**Technical Notes:**
+- Builds on existing Nostr-based node discovery (`node-nostr-discover` RPC)
+- Existing peer system: `node-add-peer`, `node-remove-peer`, `node-list-peers`
+- Need to add: connection request/approval flow (currently peers are added directly)
+- Spatial visualization could use force-directed graph or map-based layout
+- Locality data is optional and coarse-grained (city/region level, never precise)
+
+---
+
+## Settings (TBD)
+
+*User mentioned settings changes needed — details to be clarified.*