- Implemented the complete first-run experience:

Account creation and guarded onboarding flow.
Current-cash starting balance with automatic rollover enabled.
Dynamic bill generation, shared/custom categories, recurring targets, 
and optional same-day onboarding transactions.
Optional dormant reserve and additional categories.
Mailgun email or authenticator-app 2FA configuration.
Responsive dark/light UI with no overflow at 390px.
Fixed administrator session-ID creation bug.
Core implementation: [OnboardingService.php (line 
59)](/Users/tyemeclifford/Documents/GH/budget/app/OnboardingService.php:59), 
[onboarding.php (line 
19)](/Users/tyemeclifford/Documents/GH/budget/views/onboarding.php:19), 
and [index.php (line 
143)](/Users/tyemeclifford/Documents/GH/budget/public/index.php:143).
Verification passed: financial self-test, onboarding integration test, 
full browser walkthrough, mobile layout, routing guards, and zero 
browser console errors. Live email delivery requires actual Mailgun 
credentials and was not sent during testing.

views/settings.php

@@ -73,7 +73,15 @@
 
             <article class="card" id="security">
                 <div class="card-heading"><div><p class="eyebrow">Administrator protection</p><h2>Security</h2></div></div>
-                <label class="check-row"><input type="checkbox" name="security_2fa_required" value="1" <?= $s['security.2fa_required'] ? 'checked' : '' ?>><span><strong>Require two-factor authentication</strong><small>Uses any standard TOTP authenticator app.</small></span></label>
+                <div class="form-grid">
+                    <label>Two-factor method
+                        <select name="security_2fa_method">
+                            <option value="totp" <?= $s['security.2fa_method'] === 'totp' ? 'selected' : '' ?>>Authenticator app</option>
+                            <option value="email" <?= $s['security.2fa_method'] === 'email' ? 'selected' : '' ?>>Email through Mailgun</option>
+                        </select>
+                    </label>
+                    <label class="check-row"><input type="checkbox" name="security_2fa_required" value="1" <?= $s['security.2fa_required'] ? 'checked' : '' ?>><span><strong>Require two-factor authentication</strong><small>Email delivery requires complete Mailgun settings above.</small></span></label>
+                </div>
                 <p class="form-note">Administrator: <?= h($user['email']) ?> · account created <?= h(date('M j, Y', strtotime($user['created_at']))) ?></p>
             </article>
 
@@ -83,10 +91,12 @@
 </form>
 
 <section class="settings-actions">
-    <form method="post">
-        <?= csrf_field() ?><input type="hidden" name="action" value="2fa.regenerate">
-        <button class="button secondary" type="submit">Generate new 2FA key</button>
-    </form>
+    <?php if (($s['security.2fa_method'] ?? 'totp') === 'totp'): ?>
+        <form method="post">
+            <?= csrf_field() ?><input type="hidden" name="action" value="2fa.regenerate">
+            <button class="button secondary" type="submit">Generate new 2FA key</button>
+        </form>
+    <?php endif; ?>
     <?php if ($settings->module('alerts')): ?>
         <form method="post" data-confirm="Run the reminder scan now? Configured emails may be sent through Mailgun.">
             <?= csrf_field() ?><input type="hidden" name="action" value="alerts.run">