Note that this requires a minor database migration of SiteOptions in
users_info and Paranoia in users_main

2FA class stolen from RobThree and stripped down.
Works best with qrencode utility installed, but will fall back to using
google charts if qrencode is missing.

For real though how was this even left broken like this? Did what.cd
just never use this feature or did they only half-port it to their
public repo?

Should have been part of commit b1b1c6a68d

Default as of 5.7. Now enforces that NOT NULL fields are nott attempted
to be set to NULL (like whenever we do an insert without specifying a
text/blob field value (which can't have defaults))

Apparently not doing this is technically invalid

Value added to source field contains the site name and a random string.
This change prevents uploaders from using self-generated torrent files
unless they also add the source value themselves. This value is provided
to them on the upload page, but is still more inconvenient than before.