UX suggestions for 2FA from user tests

[Flix6x]

• "Please enter your authentication code generated via: email" -> "Please enter the token that was sent to you by email." (or suggest an even nicer alternative text)
• The 2FA form feels like 2 forms in 1. It would be better to hide the second form with a button "Other options" that takes you to the second form. The second form should then get a back button to go back to the first form (similar to how the first form has a back button to go back to the login form).

These two items should be done in a PR.

For the second one, see this screenshot below. Everything from "Trouble" to "Back to login" should not be visible per default, but only appear if the user hits a link named "Having trouble?".
Please test if that still works on a mobile device.

The template where to make this change is ui/templates/admin/two_factor_verify_code.html

[nhoening]

I removed the following two items, as this issue should deal with 2FA, and also it is not easy to interfere with the pwd-reset workflow (handled by flask-security, basically):

• When resetting the password, the "Instruction to reset your password has been sent" was shown twice (maybe because the reset button was clicked twice? Reproduce this first.
• The "Successfully reset password" should be a toast notification. In general, we should stop using the top-page div for notifications.

[nhoening]

Also this is not easy to work on (flask-security handles it), and the potential pay-off seems actually low in comparison:

• Once logged in successfully, the user sees a notification: YOUR CODE HAS BEEN CONFIRMED. This is redundant, as by now the user is obviously logged in.

[nhoening]

I investigated this one. Flask-security has hard-coded these words in a Python file. Unfortunately very hard to change.

• The toggle text "Send code via email" is confusing, because the code/token had already been sent by email. Maybe "Resend token via email" instead?

[nhoening]

This item I could not reproduce locally (the email was sent okay), but I did see it on the staging server. Probably an issue we should first investigate in Seita's email setup.

• The 2FA option to Contact Administrator led to an SMTPDataError: Recipient address rejected: Spam message rejected.