Settings → Security → Two-factor. Standard TOTP: 30-second steps, 6 digits, ±1 step tolerance for clock skew, constant-time comparison.
Enrollment stores the secret but leaves 2FA disabled until you confirm a working code — so an abandoned half-setup can never lock you out.
QR rendering is a deliberate omission (it needs a client-side QR library). The UI shows the secret and the otpauth:// URI for manual entry, which every authenticator app supports.
Admin accounts require 2FA in production. Note that the admin realm keeps its own 2FA flag, separate from your account-level one — enrolling as a user does not by itself unlock the console.