test(mfa): full MFA test coverage — unit + E2E

Unit tests (packages/api — 13 tests):
- generateTotpSecret: DB write, returns secret + uri
- verifyAndEnableTotp: valid token enables; invalid/already-enabled/no-secret guards
- verifyTotp (login): valid → ok; invalid → UNAUTHORIZED; not-enabled → BAD_REQUEST
- getCurrentMfaStatus: reads totpEnabled flag

E2E tests (apps/web/e2e/dev-system/mfa.spec.ts — 7 scenarios):
- Setup flow: generate secret, enable with valid code, reject invalid code, UI QR check
- Login flow: MFA prompt appears, valid code logs in, wrong code shows error + stays on prompt
- Login without MFA: no TOTP prompt for users without MFA enabled

Also: start.sh health-check timeout 30s → 90s (container startup can exceed 30s)

Co-Authored-By: claude-flow <ruv@ruv.net>

scripts/start.sh

@@ -23,8 +23,9 @@ echo "  Starting app container on port 3100..."
 docker compose --profile full up -d app
 
 # 4. Wait for server to be ready
-echo "  Waiting for server..."
-for i in {1..30}; do
+# Allow up to 90s: prisma generate + migrate deploy + next dev compilation
+echo "  Waiting for server (up to 90s)..."
+for i in {1..90}; do
   if curl -sf http://localhost:3100/api/health > /dev/null 2>&1; then
     echo ""
     echo "CapaKraken is running!"
@@ -34,9 +35,13 @@ for i in {1..30}; do
     echo "  Logs: docker logs -f capakraken-app-1"
     exit 0
   fi
+  # Print progress every 10s
+  if (( i % 10 == 0 )); then
+    echo "  Still waiting... (${i}s)"
+  fi
   sleep 1
 done
 
-echo "ERROR: Server failed to start within 30 seconds"
+echo "ERROR: Server failed to start within 90 seconds"
 echo "Check logs: docker logs --tail 100 capakraken-app-1"
 exit 1