Second factor verification step.

Called after /api/login returns totp_required=True. The pending_token identifies the half-completed login attempt; code is either a TOTP code or a backup code (if use_backup_code=true).

On success: deletes the pending row, issues a session cookie. On failure: decrements attempts_remaining. If at 0 (or already 0), deletes the row, user must re-enter password.