Security settings

The security page of the workspace settings on the docked shell. Changing the password checks strength with a meter and confirms the match before it updates. Two-factor setup opens a Dialog with a QR Code, a copyable key and an OTP Input that shakes on a wrong code, then shows ten recovery codes to copy. Active sessions list device, browser, place and last activity, with revoke on each and a sign out for every other session. API keys sit in a table with access and last use; creating one reveals the key once with a copy button, and revoking the last one leaves an empty state. Below sm, columns fold into the rows.