Start TOTP device enrollment

Generates a shared secret and returns an OTPAuth URI to be displayed as a QR code. The returned enrollment id must be passed to finish-enrollment together with the first code generated by the authenticator app.