Fixed api_access_only toggle to generate otp_secret when missing

[philayres]

Summary

Fixes #1083

When toggling an existing user to api_access_only = true, the handle_api_access_only_change callback now generates a missing otp_secret if one was never set. This can occur when a user was created while TwoFactorAuthDisabledForUser was true, so setup_two_factor_auth skipped secret generation at creation time.

Without this fix, such a user ends up with otp_secret = nil and otp_required_for_login = true, causing two_factor_setup_required? to return true. The before_action in UserBaseController then redirects every request — including token-authenticated API calls — to /users/show_otp.

Changes

• app/models/concerns/standard_authentication.rb: In handle_api_access_only_change, generate otp_secret if absent before setting otp_required_for_login = true
• spec/models/user_api_access_only_spec.rb: New test covering the gap — creates a user with 2FA disabled (no otp_secret), re-enables 2FA, toggles to api_access_only, and asserts all three conditions are correct (otp_secret present, otp_required_for_login true, two_factor_setup_required? false)