Block a user
Work list
☐ Add SimpleCov for test coverage reporting ☐ Integrate Factory Bot to replace fixtures ☐ Add database cleaner for test isolation
Security: Hash backup codes instead of storing in plain text