feat: add MFA/TOTP auth, PII encryption, agents/leads/inquiries modules, and comprehensive tests

- Add TOTP-based MFA with setup, verify, disable, backup codes, and challenge flow
- Add PII field encryption middleware with AES-256-GCM and deterministic search hashes
- Add agents, inquiries, and leads domain modules with entities, events, value objects
- Add web dashboard pages for inquiries and leads with detail dialogs
- Add 30+ component tests (valuation, charts, listings, search, providers, UI)
- Add Prisma migrations for encryption hash columns and MFA TOTP support
- Fix all ESLint errors (unused imports, duplicate imports, lint auto-fixes)
- Update dependencies and lock file
- Clean up obsolete exploration/QA docs, add audit documentation

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/package.json

@@ -42,6 +42,7 @@
     "helmet": "^8.1.0",
     "ioredis": "^5.4.0",
     "nodemailer": "^8.0.5",
+    "otplib": "^13.4.0",
     "passport": "^0.7.0",
     "passport-google-oauth20": "^2.0.0",
     "passport-jwt": "^4.0.1",
@@ -50,6 +51,7 @@
     "pino": "^10.3.1",
     "pino-pretty": "^13.0.0",
     "prom-client": "^15.1.3",
+    "qrcode": "^1.5.4",
     "reflect-metadata": "^0.2.0",
     "rxjs": "^7.8.0",
     "sanitize-html": "^2.17.2",
@@ -70,6 +72,7 @@
     "@types/passport-jwt": "^4.0.1",
     "@types/passport-local": "^1.0.38",
     "@types/pg": "^8.20.0",
+    "@types/qrcode": "^1.5.6",
     "@types/sanitize-html": "^2.16.1",
     "@types/supertest": "^7.2.0",
     "prisma": "^7.7.0",