Document the 2FA Challenge/Session Endpoints

[maugauwi-hash]

Labels: documentation, api-contract
Priority: Medium
Estimated Time: 30 minutes

Description:
Both APIClient.challenge2FA/clear2FASession (iOS, APIClient.swift:120-126) and
ApiClient.challenge2FA (Android, ApiClient.kt:80-81) are implemented against
/vaults/{id}/2fa/challenge and /vaults/{id}/2fa/session/clear, but neither endpoint appears
anywhere in shared/api-contract.md's 2FA-adjacent sections (which currently only covers status/
enable/verify/disable implicitly via the client code, not even fully documented there either).

Tasks:

• Add the full 2FA endpoint set to shared/api-contract.md, including challenge and session/clear
• Document why these two methods currently have no UI call sites on either platform (dead code — see also a potential follow-up issue if they're confirmed unused and should be removed)
• Add request/response model documentation matching TwoFactorStatus/Enable2FAResponse

---