Auth flow

/start → /code → /2fa (if exists)