Keyed to the *user*, not an identity: the factor protects the account
regardless of which identity authenticated (native today; any future
federated identity funnels through the same challenge). At most one
per user. A row with ``confirmed_on IS NULL`` is a pending enrollment
— the user has been shown the secret but hasn't proven possession yet;
it grants nothing and is replaced by a fresh enrollment attempt.
``secret`` is Fernet-encrypted at rest (``skynet_db.security``) — TOTP
verification needs the plaintext secret, so hashing is not an option
the way it is for passwords/recovery codes.