feat!: bypass superpin environment settings

[marcoraddatz]

BREAKING CHANGE

This PR introduces the ability to bypass certain environment restrictions.

Use case

There are situations where you may need to provide a third party with access to your system, such as when Apple’s app store review team requires a username and password to log in. Previously, logging in with a superpin in a production environment was not possible because the user wouldn’t receive an email notification.

This PR enhances the security of the package in two key ways:

1. You can now manually specify which environments allow the use of a superpin (enabled on testing and local by default). Production will continue to be disabled.
2. Specific identifiers can bypass environment checks. For example, a user with a particular email address can log in to production, even if production is disabled in the environment settings.

Migration

• Move your superpin configuration from config('totp-login.superpin') to config('totp-login.superpin.pin').
• Optionally, add the other totp-login.superpin.* config entries. The staging system is not allowed to use the superpin by default.