Function setup_mfa 

pub async fn setup_mfa(
    __arg0: State<ApiState>,
    headers: HeaderMap,
) -> ApiResponse<MfaSetupResponse>

POST /mfa/setup — initiate MFA enrollment.

Generates a new TOTP secret and ten backup codes, stores them as pending (TTL 10 min), and returns:

• secret – base32-encoded secret for manual entry into an authenticator
• qr_code – otpauth:// URI that can be converted to a QR code
• backup_codes – shown once; user must save these before calling /mfa/verify