feat: improve account security

Support TOTP 2fa, allow for changing password, add session management
and account removal.

server/api/account/password.get.ts

@@ -0,0 +1,29 @@
+import { db } from '~~/server/lib/db';
+
+/**
+ * Reports when the password was last changed, or null if it is still the one
+ * the account was created with. The credential account row is only written
+ * when the account is created and when its password changes, so its
+ * updatedAt is the time of the last change.
+ */
+export default defineEventHandler(async (event) => {
+    await protectRoute(event);
+
+    const userId = event.context.user!.id as string;
+
+    const account = await db.query.accounts.findFirst({
+        where: {
+            userId,
+            providerId: 'credential',
+        },
+    });
+
+    if (!account) {
+        return { changedAt: null };
+    }
+
+    // the two timestamps are written a moment apart on sign up
+    const changed = account.updatedAt.getTime() - account.createdAt.getTime() > 1000;
+
+    return { changedAt: changed ? account.updatedAt : null };
+});