- Implemented the complete first-run experience:

Account creation and guarded onboarding flow.
Current-cash starting balance with automatic rollover enabled.
Dynamic bill generation, shared/custom categories, recurring targets, 
and optional same-day onboarding transactions.
Optional dormant reserve and additional categories.
Mailgun email or authenticator-app 2FA configuration.
Responsive dark/light UI with no overflow at 390px.
Fixed administrator session-ID creation bug.
Core implementation: [OnboardingService.php (line 
59)](/Users/tyemeclifford/Documents/GH/budget/app/OnboardingService.php:59), 
[onboarding.php (line 
19)](/Users/tyemeclifford/Documents/GH/budget/views/onboarding.php:19), 
and [index.php (line 
143)](/Users/tyemeclifford/Documents/GH/budget/public/index.php:143).
Verification passed: financial self-test, onboarding integration test, 
full browser walkthrough, mobile layout, routing guards, and zero 
browser console errors. Live email delivery requires actual Mailgun 
credentials and was not sent during testing.

app/Settings.php

@@ -33,6 +33,7 @@ final class Settings
         'mailgun.region' => 'us',
         'mailgun.from' => 'Budget Planner <budget@example.com>',
         'security.2fa_required' => false,
+        'security.2fa_method' => 'totp',
     ];
 
     public function __construct(private PDO $pdo)
@@ -52,6 +53,13 @@ final class Settings
         return json_last_error() === JSON_ERROR_NONE ? $decoded : $value;
     }
 
+    public function has(string $key): bool
+    {
+        $statement = $this->pdo->prepare('SELECT COUNT(*) FROM settings WHERE setting_key = :key');
+        $statement->execute(['key' => $key]);
+        return (int) $statement->fetchColumn() > 0;
+    }
+
     public function set(string $key, mixed $value): void
     {
         $encoded = json_encode($value, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);