Remove all TOTP devices for a user

Soft-deletes all active TOTP devices for the given user. Intended for admins to recover users who are locked out after losing their device. Requires WRITE_USERS or UNLOCK_USERS permission.