The backend 2FA endpoints are part of the roadmap, and the route is already in place so the UI can evolve into OTP enrollment and challenge flows without moving the auth architecture again.