Offline 2FA authenticator: TOTP codes, no network permission, no accounts.
