Add guardrail for disable 2fa

backend/internal/2fa.js

@@ -163,6 +163,9 @@ const internal2fa = {
 		const result = await verify({
             token: code,
             secret: auth.meta.totp_secret,
+            guardrails: createGuardrails({
+                MIN_SECRET_BYTES: 10,
+            }),
         });
 
 		if (!result.valid) {