Returns the TOTP 2FA enrollment payload.

The bits an authenticator app needs to enroll the caller: shared key plus an otpauth:// URI to feed a QR generator. When 2FA is already on, only the IsEnabled flag comes back — no leaking the secret twice.