fix: real security-settings actions + leak-free upload progress (#1508-#1511)

[monique-7arch]

Minimal, additive changes addressing the four assigned issues.

• Security settings: the two-factor toggle only flips local state #1508 setTwoFactor() actually persists the 2FA toggle
• Security settings: 'Active sessions' are hard-coded mock data and 'Revoke' only removes a row locally #1509 listSessions()/revokeSession() replace mock sessions and local-only revoke
• Security settings: 'Delete account' signs the user out and says the account is deleted without deleting anything #1510 deleteAccount() calls the API instead of only signing out
• Upload page fakes progress and leaks its interval on errors #1511 createProgressTracker() owns its interval and clears it on done/fail

Issues

Closes #1508
Closes #1509
Closes #1510
Closes #1511

[vercel]

@BigBen-7 is attempting to deploy a commit to the Mftee's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@monique-7arch Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits