- Email 2FA is now optional and disabled by default.

Existing and new accounts default to 2FA off.
Registration signs users in directly.
Users can enable it under My Account.
Administrators can manage it under Users & Staff.
Verified password-only and opted-in email-code login flows.
PHP/JavaScript checks and browser console passed.

views/auth/register.php

@@ -5,7 +5,7 @@
             <h1>Faster pickup starts here.</h1>
             <p>Create an account to keep your contact details, see order history, and hear about new specials.</p>
             <ul class="check-list">
-                <li>Email verification protects your account</li>
+                <li>Optional email 2FA can be enabled from My Account</li>
                 <li>Newsletter preferences stay in your control</li>
                 <li>Your payment details are handled by Square, not stored here</li>
             </ul>