fix(2fa): accept display forms of the TOTP secret and never panic on a bad one (#7113)

gotp decodes the stored secret with strict base32 and panics when that fails,
so a 2FA secret saved through the settings API in lower case, grouped by
spaces, or not base32 at all turned every login and every attempt to turn 2FA
off into an HTTP 500. An empty secret had the opposite problem: the login
check accepted the code of an empty HMAC key, which anyone can compute.

VerifyWithSkew now normalizes the secret and verifies nothing for an empty or
non-base32 one, so secrets already stored in a display form work again.
Turning 2FA on through the settings update stores the normalized secret and
refuses one no authenticator could match.

internal/web/service/panel/user_test.go

@@ -4,6 +4,9 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
+	"time"
+
+	"github.com/xlzd/gotp"
 
 	"github.com/mhsanaei/3x-ui/v3/internal/database"
 	"github.com/mhsanaei/3x-ui/v3/internal/database/dbtest"
@@ -74,3 +77,36 @@ func TestUserSettersRefuseNamesTheLoginRouteRefuses(t *testing.T) {
 		t.Fatalf("stored username = %q (%v), want it unchanged", stored.Username, err)
 	}
 }
+
+// A stored 2FA secret in a form gotp cannot decode made every login panic (HTTP 500).
+func TestCheckUserTwoFactorSecretForms(t *testing.T) {
+	cases := []struct {
+		name, stored, codeSecret string
+		want                     bool
+	}{
+		{"canonical", "JBSWY3DPEHPK3PXP", "JBSWY3DPEHPK3PXP", true},
+		{"lower case", "jbswy3dpehpk3pxp", "JBSWY3DPEHPK3PXP", true},
+		{"not base32", "totp-secret", "JBSWY3DPEHPK3PXP", false},
+		{"empty secret", "", "", false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			dbtest.InitDB(t, filepath.Join(t.TempDir(), "x-ui.db"))
+			svc := &UserService{}
+			if err := svc.UpdateFirstUser("admin", "s3cret-Pass"); err != nil {
+				t.Fatalf("UpdateFirstUser: %v", err)
+			}
+			if err := svc.settingService.SetTwoFactorEnable(true); err != nil {
+				t.Fatal(err)
+			}
+			if err := svc.settingService.SetTwoFactorToken(tc.stored); err != nil {
+				t.Fatal(err)
+			}
+			code := gotp.NewDefaultTOTP(tc.codeSecret).AtTime(time.Now())
+			user, err := svc.CheckUser("admin", "s3cret-Pass", code)
+			if got := err == nil && user != nil; got != tc.want {
+				t.Fatalf("CheckUser with stored secret %q: ok = %v (%v), want %v", tc.stored, got, err, tc.want)
+			}
+		})
+	}
+}