docs(planning): rename remaining 2fa roadmap wording to totp

Co-authored-by: Peter Ryszkiewicz <pRizz@users.noreply.github.com>

Author: cursoragent

.planning/ROADMAP.md

@@ -47,7 +47,7 @@ Decimal phases appear between their surrounding integers in numeric order.
 - [x] **Phase 33: Investigate and implement a way for users that get created and configured in the container are persisted after we update the container** - Persist container users across updates
 - [ ] **Phase 34: Disable Cockpit User-Facing Surface** - TBD
 - [x] **Phase 35: Can we add a new update subcommand to update the opencode-cloud binary itself? We might need to be careful with respect to how the binary was installed with which package manager and whether it is the rust or npm binary** - Add update CLI subcommand for self-updating opencode-cloud
-- [ ] **Phase 36: Investigate and persist the 2FA setup file (~/.google_authenticator) across container upgrades** - TBD
+- [ ] **Phase 36: Investigate and persist the TOTP setup file (~/.google_authenticator) across container upgrades** - TBD
 - [x] **Phase 37: extract the "/usr/local/bin/opencode-cloud-setup.sh" content from infra/aws/cloudformation/opencode-cloud-quick.yaml into a script or multiple scrips in the opencode-cloud repo and use those instead of having the content in infra/aws/cloudformation/opencode-cloud-quick.yaml; we should do the same for infra/aws/cloud-init/opencode-cloud-quick.yaml; we should do this to improve provisioning reusability for other cloud providers** - Complete
 
 ## Phase Details
@@ -625,7 +625,7 @@ Plans:
 **Details:**
 Implemented `occ update cli` with install detection, restart flow, and docs guidance.
 
-### Phase 36: Investigate and persist the 2FA setup file (~/.google_authenticator) across container upgrades
+### Phase 36: Investigate and persist the TOTP setup file (~/.google_authenticator) across container upgrades
 
 **Goal:** [To be planned]
 **Depends on:** Phase 35
@@ -691,7 +691,7 @@ Phases execute in numeric order: 1 -> 2 -> 3 -> ... -> 33 -> 34 -> 35 -> 36 -> 3
 | 33. Investigate and implement a way for users that get created and configured in the container are persisted after we update the container | 1/1 | Complete | 2026-02-01 |
 | 34. Disable Cockpit User-Facing Surface | 0/0 | Not started | - |
 | 35. Update opencode-cloud self-update | 1/1 | Complete | 2026-01-31 |
-| 36. Investigate and persist the 2FA setup file (~/.google_authenticator) across container upgrades | 0/0 | Not started | - |
+| 36. Investigate and persist the TOTP setup file (~/.google_authenticator) across container upgrades | 0/0 | Not started | - |
 | 37. Extract opencode-cloud setup scripts | 1/1 | Complete | 2026-02-02 |
 
 ---

.planning/STATE.md

@@ -250,7 +250,7 @@ Recent decisions affecting current work:
 - Phase 34 added: Disable Cockpit user-facing surface (hide UI/CLI/docs, keep code)
 - Phase 35 added: Can we add a new update subcommand to update the opencode-cloud binary itself? We might need to be careful with respect to how the binary was installed with which package manager and whether it is the rust or npm binary
 - Phase 35 completed: update cli self-update flow and docs
-- Phase 36 added: Investigate and persist the 2FA setup file (~/.google_authenticator) across container upgrades
+- Phase 36 added: Investigate and persist the TOTP setup file (~/.google_authenticator) across container upgrades
 - Phase 37 added: extract the "/usr/local/bin/opencode-cloud-setup.sh" content from infra/aws/cloudformation/opencode-cloud-quick.yaml into a script or multiple scrips in the opencode-cloud repo and use those instead of having the content in infra/aws/cloudformation/opencode-cloud-quick.yaml; we should do the same for infra/aws/cloud-init/opencode-cloud-quick.yaml; we should do this to improve provisioning reusability for other cloud providers
 - Phase 37 completed: extracted shared provisioning scripts and bootstrapped AWS templates
 

.planning/phases/21-use-opencode-fork-with-pam-auth/21-01-PLAN.md

@@ -169,7 +169,7 @@ RUN printf '%s\n' \
     'auth required pam_unix.so' \
     'account required pam_unix.so' \
     '' \
-    '# Optional: Enable TOTP 2FA (uncomment when pam_google_authenticator is installed)' \
+    '# Optional: Enable TOTP authentication (uncomment when pam_google_authenticator is installed)' \
     '# auth required pam_google_authenticator.so' \
     > /etc/pam.d/opencode \
     && chmod 644 /etc/pam.d/opencode
@@ -181,7 +181,7 @@ RUN ls -la /etc/pam.d/opencode && cat /etc/pam.d/opencode
 **Key points:**
 - Switch to root user (PAM config must be in /etc/pam.d/)
 - Create file with standard UNIX authentication
-- Include commented 2FA option for future use
+- Include commented TOTP option for future use
 - Set appropriate permissions (644)
 - Verify file creation
 

.planning/phases/21-use-opencode-fork-with-pam-auth/21-01-SUMMARY.md

@@ -41,7 +41,7 @@ metrics:
 
 - **opencode-broker build:** Added section to clone fork, build Rust broker binary from `packages/opencode-broker`, install to `/usr/local/bin/opencode-broker` with setuid permissions (4755) for PAM access.
 
-- **PAM configuration:** Created `/etc/pam.d/opencode` with standard UNIX authentication (`pam_unix.so`) for both auth and account modules. Includes commented 2FA option for future use.
+- **PAM configuration:** Created `/etc/pam.d/opencode` with standard UNIX authentication (`pam_unix.so`) for both auth and account modules. Includes commented TOTP option for future use.
 
 - **opencode-broker.service:** Created systemd unit file with Type=notify, security hardening settings, RuntimeDirectory for socket creation, and enabled via symlink.
 
@@ -62,6 +62,6 @@ metrics:
 
 - Bun is installed inline during opencode build (not pre-installed in Dockerfile)
 - Broker build runs as root to set setuid permissions, then switches back to opencode user
-- PAM config uses standard UNIX authentication; 2FA support is commented for future use
+- PAM config uses standard UNIX authentication; TOTP support is commented for future use
 - opencode.json config is created during build to ensure auth is enabled by default
 - Both services are enabled via symlinks (systemctl doesn't work during Docker build)

.planning/phases/21-use-opencode-fork-with-pam-auth/21-CONTEXT.md

@@ -162,7 +162,7 @@ Target state:
 - **File**: `packages/opencode-broker/service/opencode.pam`
 - **Install location**: `/etc/pam.d/opencode`
 - **Contents**: Standard UNIX auth (`pam_unix.so`) for auth and account
-- **Optional**: 2FA support via `pam_google_authenticator.so` (deferred for now)
+- **Optional**: TOTP support via `pam_google_authenticator.so` (deferred for now)
 
 ### opencode Configuration
 - **Config file**: `~/.config/opencode/opencode.json` or similar

.planning/phases/21-use-opencode-fork-with-pam-auth/21-VERIFICATION.md

@@ -147,7 +147,7 @@ None. All code follows expected patterns:
 **PAM configuration (lines 465-479):**
 - ✓ Creates /etc/pam.d/opencode
 - ✓ Contains pam_unix.so for auth and account
-- ✓ Includes commented 2FA option
+- ✓ Includes commented TOTP option
 - ✓ Sets 644 permissions
 - ✓ Verifies file creation