Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

Affected component: Sync-in Server v2.3.0, POST /api/auth/token auth.controller.ts:50-55. Required attacker capability: Valid username and password for a 2FA-enabled account. Summary POST /api/auth/token authenticates with username and password only, then calls getTokens, which returns unrestrict...