Profile → 2FA:
1. Enable authenticator app (TOTP).
2. Scan QR and confirm a code.
3. Store backup codes offline.
2FA protects billing and server actions even if your password leaks.