const loginWith2FA = async (email, password) => {
  // 1. Login normal
  const loginResponse = await fetch('/auth/signin', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ email, password })
  });

  if (loginResponse.status === 200) {
    const { access_token, requires2FA } = await loginResponse.json();

    if (requires2FA) {
      // 2. Solicitar OTP
      const otpCode = await showOTPModal();

      // 3. Verificar OTP
      const otpResponse = await fetch('/auth/otp/verify', {
        method: 'POST',
        headers: {
          'Authorization': `Bearer ${access_token}`,
          'Content-Type': 'application/json'
        },
        body: JSON.stringify({ token: otpCode })
      });

      if (otpResponse.ok) {
        // Login completo
        localStorage.setItem('access_token', access_token);
        window.location.href = '/dashboard';
      }
    } else {
      // Login sem 2FA
      localStorage.setItem('access_token', access_token);
      window.location.href = '/dashboard';
    }
  }
};