[BryanFRD]

Adds TotpEnrollment::verify_step_at and verify_step_now, which return the matched step and reject any step at or before last_used_step. Callers persist the returned step atomically with the login to enforce RFC 6238 section 5.2.

verify_at and verify_now keep their signatures (additive, not breaking).

Closes #348

[ferrfleet-interne]

Correct. In totp-rs 6.0.0, check returns Option<u64>, the first matching counter in the skew window, so filtering on step > last gives the RFC 6238 §5.2 one-time-use rule. is_none_or needs Rust 1.82, and the MSRV is 1.85. Keeping the local unix_now() instead of check_current is right, because check_current panics on a pre-epoch clock.

Nit: verify_at and verify_now still accept replayed codes, and their docs don't say so. Add a line pointing callers to verify_step_* for login, or deprecate them, so new code doesn't pick the version without replay protection.