Add password hashing, user settings with 2FA, and project image lightbox.

Hardens auth with PBKDF2, lockouts, local QR setup, and safer embeds while moving account security under the username menu.

README.md

@@ -9,13 +9,20 @@ wallpaper, plus English/Turkish localization.
 - Public site: home, about, my projects (with an image/iframe carousel per project),
   affiliate links, dynamic social icons in the footer, and a changeable background wallpaper.
 - Admin panel (`/admin`) protected by Forms Authentication:
+  - My Projects (bilingual posts + media carousel)
+  - Affiliate Links (bilingual cards with logos)
+  - Social Icons (footer icons)
+  - Wallpaper (site-wide background image)
+  - Optional TOTP two-factor authentication (Security page)
   - My Projects: create/edit posts with EN/TR translations and a media manager
     (upload images or embed iframes, drag-free reordering via a sort order field).
   - Affiliate Links: create/edit links with a logo, title, description and EN/TR translations.
   - Social Icons: manage the icon row shown in the site footer (Font Awesome classes + URLs).
   - Wallpaper: upload a new background image for the whole site, or reset to the default.
+  - Security: optional TOTP two-factor authentication (Google Authenticator / Authy / etc.).
   - Image uploads everywhere support both the regular file picker **and** pasting an
     image straight from the clipboard (Ctrl+V).
+- Public my-projects images open in a larger lightbox when clicked.
 - English / Turkish localization via `.resx` resource files and a culture cookie.
 
 ## Tech stack
@@ -110,9 +117,12 @@ runtime data, not source code.
 This project was open-sourced as a personal portfolio/reference, not as a hardened
 multi-tenant product. A few things worth knowing if you deploy your own copy or build on it:
 
-- **Passwords are stored and compared in plain text** (`loginController`). If you plan to
-  expose this beyond your own local use, replace this with a proper password hash
-  (e.g. BCrypt/PBKDF2) before going live.
+- Optional **TOTP 2FA** and **password change** live under Admin → username menu → User Settings.
+  Existing installs can run `database/add-2fa.sql` then `database/harden-auth.sql`.
+- Passwords are stored with **PBKDF2-SHA256** (`PasswordHasher`). On first successful login after
+  upgrade, any leftover plaintext password is rehashed automatically.
+- **Passwords used to be stored in plain text.** If you fork an old clone, force a password change
+  and rotate machine keys before going live.
 - The admin panel already includes `[Authorize]` on every management action and
   `[ValidateAntiForgeryToken]` on every state-changing POST, so it's protected against CSRF
   once you're logged in — but access is still gated by a single shared admin login rather