:::endpoint POST /v1/auth/token/two-factor/setup

The first half of setting up two-factor during a sign-in, for the Propper app.
Send the `challenge` from a [sign-in](/docs/api/apps/sign-in#response-two-factor-to-set-up)
that answered `two_factor_setup_required`, and add what comes back to an
authenticator app.

Asking again makes a new secret, and the one before it stops working. Only the
entry added last can confirm.

## Request

```bash
curl -X POST https://api.proppertrading.com/v1/auth/token/two-factor/setup \
  -H "Content-Type: application/json" \
  -d '{"challenge": "c3a91f0e5b7d2c4e6a8f1b3d5c7e9a0b2d4f6a8c1e3b5d7f9a0c2e4b6d8f1a3c"}'
```

## Response

```json
{
    "data": {
        "object": "two_factor_secret",
        "secret": "MZXW6YTBOI4HKZLH",
        "otpauth_url": "otpauth://totp/Propper:jamie%40acmefunded.com?secret=MZXW6YTBOI4HKZLH&issuer=Propper&algorithm=SHA1&digits=6&period=30"
    },
    "meta": { "request_id": "req_01kz4bkr1aj1gv63d8fv3133ey" }
}
```

| Field         | Description |
| ------------- | ----------- |
| `secret`      | The key in base32, for typing into an authenticator by hand |
| `otpauth_url` | The same as a link. On an iPhone, opening it offers to add the code to Passwords, which then fills it in by itself |

The secret is written to the account straight away, but it does not count until
it is confirmed. Until then the account still has no two-factor.

## Errors

| Status | Code                           | Meaning                                                                   |
| ------ | ------------------------------ | ------------------------------------------------------------------------- |
| 401    | `expired_two_factor_challenge` | Expired, already used, not a setup challenge, or two-factor was set up somewhere else in the meantime. Start again from the password |
| 422    | `validation_failed`            | No challenge, or not one in the right shape                               |
| 429    | `rate_limit_exceeded`          | Shares the limit of the two-factor step                                   |