Returns a TOTP secret and an otpauth:// provisioning URI for a business. Render the URI as a QR code (or expose the base32 secret) so the operator can add the entry to their authenticator app, then call /business/resume/setup-two-factor with the first 6-digit code. — Requires 'totp' to be present in the application's allowedScaMethods. — Requires an active SCA session granted within the last 15 minutes, else 30070 (SCA_REQUIRED) with reason NO_SESSION or EXPIRED, exactly as the SCA-gated reads report it; run /business/login/start + /business/login/complete and retry inside the window.