- Rename database columns: 2fa_* -> mfa_* - Update all PHP code references to use mfa_* fields - Maintain API backward compatibility (still returns two_factor_enabled) - Keep all route URLs unchanged - Add migration to rename columns in users table