nx_totp_uri.nx

totp_uri.nx -- build otpauth:// enrollment URIs. Google Authenticator Key URI Format (de-facto standard, used by Authy / 1Password / Microsoft Authenticator / Duo). A QR code encodes this URI; scanning provisions a new OTP account. Shape: otpauth://totp/Label?secret=BASE32SECRET&issuer=Name&algorithm=SHA1 &digits=6&period=30 Label is typically \"Issuer:user@example.com\" (colon-separated). Secret is a base32-encoded arbitrary-length key -- 20 bytes is the RFC 6238 recommended length for SHA-1. Composes base32.nx (for secret encoding) + url.nx (for percent-encoding the label + issuer). Invariants: TU1 Secret bytes are base32-encoded with '=' padding stripped (most authenticator apps tolerate padding but some reject it). TU2 Label / issuer percent-encoded so `@`, spaces, `:` are safe in the URI. TU3 Default params (digits=6, period=30, algo=SHA1) match what Google Authenticator assumes on missing params. We emit them anyway for clarity + compat with strict parsers.