fix: update TOTP fixtures and tests to avoid conflicts with existing enrollment tests

- user10 gets enabled TOTP (for CalDAV 2FA test)
- user1 gets enrolled-but-not-enabled TOTP (for existing QR/settings tests)
- TOTP enrollment test uses user2 (no TOTP fixture) instead of user1

pkg/db/fixtures/totp.yml

@@ -3,3 +3,9 @@
   secret: 'JBSWY3DPEHPK3PXP'
   enabled: true
   url: 'otpauth://totp/Vikunja:user10?secret=JBSWY3DPEHPK3PXP&issuer=Vikunja'
+# user1 has TOTP enrolled but not yet enabled — used by existing TOTP enrollment tests
+- id: 2
+  user_id: 1
+  secret: 'HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ'
+  enabled: false
+  url: 'otpauth://totp/Vikunja:user1?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=Vikunja'

pkg/webtests/user_totp_test.go

@@ -28,7 +28,8 @@ import (
 
 func TestUserTOTPLocalUser(t *testing.T) {
 	t.Run("Enroll TOTP for local user", func(t *testing.T) {
-		rec, err := newTestRequestWithUser(t, http.MethodPost, apiv1.UserTOTPEnroll, &testuser1, "", nil, nil)
+		// Use testuser15 who has no TOTP enrollment in fixtures
+		rec, err := newTestRequestWithUser(t, http.MethodPost, apiv1.UserTOTPEnroll, &testuser15, "", nil, nil)
 		require.NoError(t, err)
 		assert.Equal(t, http.StatusOK, rec.Code)
 		assert.Contains(t, rec.Body.String(), `"secret"`)
@@ -37,6 +38,7 @@ func TestUserTOTPLocalUser(t *testing.T) {
 	})
 
 	t.Run("Get TOTP QR Code for enrolled local user", func(t *testing.T) {
+		// user1 has TOTP enrolled (but not enabled) via fixtures
 		rec, err := newTestRequestWithUser(t, http.MethodGet, apiv1.UserTOTPQrCode, &testuser1, "", nil, nil)
 		require.NoError(t, err)
 		assert.Equal(t, http.StatusOK, rec.Code)
@@ -44,6 +46,7 @@ func TestUserTOTPLocalUser(t *testing.T) {
 	})
 
 	t.Run("Get TOTP settings for enrolled local user", func(t *testing.T) {
+		// user1 has TOTP enrolled (but not enabled) via fixtures
 		rec, err := newTestRequestWithUser(t, http.MethodGet, apiv1.UserTOTP, &testuser1, "", nil, nil)
 		require.NoError(t, err)
 		assert.Equal(t, http.StatusOK, rec.Code)