New

• auth: add MFA verification step to SPA login flow
• spa: add favicon and dynamic page titles per route
• spa: complete dashboard with all pages, analytics, and full API coverage

Fixed

• spa: add aria-modal, role=dialog, and aria-labelledby to Modal component
• spa: allow session auth on API endpoints for SPA dashboard access
• ci: allowlist frontend SPA pages in gitleaks to permit curl example snippets