Set up two-factor authentication

Scan the QR code with Google Authenticator, 1Password or similar, then confirm a code. Required for practitioner accounts, recommended for everyone.