Add reusable two-factor verification for login and money operations (#32)

README.md

@@ -21,7 +21,7 @@ Sendico integration are not implemented.
 | [`website/`](website/README.md) | Astro public website, assets, brand references and hosting configuration |
 | [`frontend/app/`](frontend/app/README.md) | Flutter consumer app with a web runner |
 | [`sxchnge_theme`](frontend/packages/sxchnge_theme/README.md) | Reusable light/dark themes and bundled Onest font |
-| [`sxchnge_auth`](frontend/packages/sxchnge_auth/README.md) | Shared login/signup/verification contracts, providers and dummy services |
+| [`sxchnge_auth`](frontend/packages/sxchnge_auth/README.md) | Shared auth contracts, providers, two-factor page and dummy services |
 | [`sxchnge_analytics`](frontend/packages/sxchnge_analytics/README.md) | Typed journey events, recorder and bounded in-memory dummy analytics |
 | [`backend/`](backend/README.md) | Planned BFF and Sendico integration boundaries |
 | [`.agents/skills/`](.agents/skills) | Repository agent skills |
@@ -210,3 +210,17 @@ by mobile clients. Transactions, rates, fees, recipients and profile storage are
 explicitly simulated and reset on reload. No real money moves. See the
 [workspace UX plan](docs/ux/exchange-workspace.md) and
 [implementation record](docs/implementation.md) for scope and validation.
+
+## Two-factor verification
+
+Account **Settings → Two-factor verification** enables or disables protection
+with a confirmed code. When enabled, login, top-ups, exchanges and payouts use a
+shared SXCHNGE-themed challenge page. Money challenges retain the reviewed fees
+and funds movement; cancelling preserves the transaction draft.
+
+The initial service uses email-code fixtures: **123456** is the local test code.
+No email is sent and settings reset on reload. Method-aware contracts and page
+instructions also support authenticator challenges; actual TOTP enrollment,
+validation and recovery remain backend integration work. See the
+[two-factor UX contract](docs/ux/two-factor.md) and
+[shared auth package](frontend/packages/sxchnge_auth/README.md).