Per-user two-factor auth in CakePHP with CakeDC/Users (opt-in, one method)

CakeDC/Users ships TOTP 2FA as all-or-nothing. Here's how to make it per-account opt-in with a single overridden method, a self-service enrolment screen, and the endroid v6 QR gotcha to avoid.