security: fix the review leftovers (owner, 08 §6)

- Asterisk doesn't load app_system, func_shell, app_disa, res_agi, app_externalivr.
- Turning two-step sign-in on asks for the password again.
- *97/*98: one voicemail login at a time per phone, 10 an hour (sp-sub-vmlimit).
- /prov: an unknown MAC gets the same 401 as a known one.
- The login limiter sweeps keys past every window.
Also the v1 checklist with the owner's results from 2026-10-21.

packages/shared/src/auth.ts

@@ -40,5 +40,6 @@ export const TotpEnableSchema = z.object({
     .string()
     .trim()
     .regex(/^\d{6}$/, 'The 6-digit code from the app'),
+  password: z.string().min(1).max(200),
 });
 export const PasswordConfirmSchema = z.object({ password: z.string().min(1).max(200) });