cpalv

this seems pretty reasonable to me. I can put something together an open a PR if there are no objections

> is easily captured by screen recording/screen sharing. shoulder surfers?

Not sure I understand the "Lobby: Password" use case. The sensitive information is already hidden by the "password" input type. Im not exactly sold on the advanced toggle. If its...

On another note, I noticed extensive use of jquery's `$().click()` method. Which has been [deprecated](https://api.jquery.com/click-shorthand/). Are there any plans to update? Or is it not a concern?

I tried to move the OTP seed into the otp_qrcode div https://github.com/opnsense/core/blob/b49b935bb9f80e34358f13dc380e63e0a54eff27/src/www/system_usermanager.php#L933-L945 like so ```