Two-factor authentication (Google Authenticator)

Associate accounts must use 2FA. It is enabled on first successful password login.

Setup:
1. Enter email and password on Associate login.
2. The portal shows a QR code and a manual secret key.
3. Open Google Authenticator (or Authy / Microsoft Authenticator), add the account by scanning the QR (or typing the key).
4. Enter the current 6-digit PIN and submit Validate & enable 2FA.
5. You are signed out. Sign in again: password, then the PIN from the app.

Every later login asks for the PIN. Codes rotate every 30 seconds. If you lose the authenticator, ask admin to reset 2FA on your user.