Add Two-factor authentication (2fa)

[sylvain101010]

Design:

• Add pending_sessions table with a failed_attempts field (and change pending_users failed_verifications to the same name).
• on login, the server check if user has 2fa enabled
• if no, it returns the login credentials
• if yes, it returns the pending_session id which should be resent back by the client with the associated 2fa code.