fix: auth/2FA — password change requires 2FA gate, admin self-deletion blocked, twofa JSON responses, per-IP email-verify budget, OptionalAuth log sanitised

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/mw/auth.go

@@ -53,7 +53,7 @@ func OptionalAuth(next http.Handler) http.Handler {
 
 			userID, role, jti, err := auth.VerifyToken(tokenString, r.Context())
 			if err != nil {
-				log.Printf("OptionalAuth: invalid token: %v", err)
+				log.Printf("OptionalAuth: invalid token ignored")
 			} else {
 				ctx := context.WithValue(r.Context(), UserIDKey, userID)
 				ctx = context.WithValue(ctx, UserRoleKey, role)