getQRCodeInline() returns a base64 data URI (data:image/svg+xml;base64,…), not raw SVG — so {!! !!} dumped it as text. Render it via <img src> with a light quiet-zone. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Custom Livewire auth (full-page, R1/R2): Login (rate-limited), TwoFactorChallenge, TwoFactorSetup (QR via pragmarx/google2fa-qrcode), PasswordChange. - Guard: panel routes behind auth + EnsureSecurityOnboarded middleware — forces password rotation, then 2FA enrolment, before the panel unlocks. - User: two_factor_secret (encrypted), two_factor_confirmed_at, must_change_password. - Centered auth layout, POST logout, dynamic sidebar user + 2FA status. - Seeded admin with a one-time password + must_change_password. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
boban