Generates a fresh authenticator secret for the caller and returns the otpauth:// URL (render as a QR code) plus the base32 secret for manual entry. The secret is returned only here; it is not confirmed until a code is submitted to /v1/totp/enroll/confirm. Re-enrolling replaces any existing authenticator and requires re-confirmation. The body is optional: current_password is required only when a confirmed authenticator already exists, since that enrollment un-confirms the live second factor. Omitting it then returns 422 on current_password.