Add reusable two-factor verification for login and money operations (#32)

docs/implementation.md

@@ -321,3 +321,40 @@ above describe delivery-time state and are superseded by this integration record
 
 Validation of the combined tree: all 115 frontend tests and app analysis passed;
 diff checks passed. Branches were retained. No checks were bypassed.
+
+## Reusable two-factor verification — task #32
+
+Branch `two-factor-32` adds a SXCHNGE-designed, theme-based code page reused by
+login, top-up, exchange, payout and verified profile enable/disable. EN/RU copy,
+one accessible input, keyboard/paste support, resend cooldown, invalid/expired/
+locked/unavailable recovery and cancellation preserve context. Transaction
+verification retains its reviewed funds movement and fees. No Sendico UI or code
+was copied for this feature.
+
+Shared auth owns explicit DTOs, mappers, domain models, service contracts and
+providers. Method-aware contracts distinguish email and authenticator challenges;
+the initial email fixture uses code `123456`, sends no email, defaults off and
+resets on reload. Real TOTP enrollment, method selection, delivery, recovery and
+backend enforcement remain integration work. Mobile can reuse the page and
+providers with its own router/localization and service adapters.
+
+Login stays pending until approval is consumed. The dummy wallet consumes a
+purpose/quote-bound, expiring, one-use approval before execution. Concurrent
+idempotent retries debit once; expired quotes require fresh review; uncertain
+outcomes retain reconciliation. Timers stop on route/app disposal and late
+responses are ignored. Settings update only after service confirmation. Analytics
+retains parent journey correlation and distinguishes verification from actual
+login/settings/settlement outcomes; codes, grants and targets never enter events.
+
+Frontend and UX review covered the complete task diff. Validation passed:
+`dart format --output=none --set-exit-if-changed` for all 34 changed Dart files;
+`flutter analyze` in app, sxchnge_auth, sxchnge_wallet and sxchnge_analytics;
+`make test-frontend` (147 tests); `flutter build web` (including Wasm dry run);
+`git diff --check`. Browser checks at 1280×720 and 390×844 verified themed layout,
+invalid-code recovery, keyboard entry and confirmed settings. Widget tests cover
+Russian at 320px/1.6× text scale and all money entry points. No security scan was
+requested or run. Earlier validation failures were corrected, including ARB
+metadata handling, disabled-policy latency, route timer disposal and lint findings.
+
+See [the UX and measurement contract](ux/two-factor.md) and
+[shared auth integration guide](../frontend/packages/sxchnge_auth/README.md).