Two-factor sign-in codes are temporarily disabled for testing (no outbound email on this server). Re-enable TWO_FA_ENABLED in includes/config.php before going live.