refactor: Phase 1 code cleanup - constants, logging, and repository organization

dashcaddy-api/routes/auth/totp.js

@@ -25,6 +25,8 @@ module.exports = function(ctx) {
     let secret;
     if (req.body && req.body.secret) {
       secret = req.body.secret.replace(/\s/g, '').toUpperCase();
+      // Normalize common Base32 confusions: 0→O, 1→L, 8→B
+      secret = secret.replace(/0/g, 'O').replace(/1/g, 'L').replace(/8/g, 'B');
       if (!/^[A-Z2-7]{16,}$/.test(secret)) {
         return ctx.errorResponse(res, 400, 'Invalid secret key format. Must be a Base32 string (letters A-Z and digits 2-7).');
       }