diff --git a/.phase9-state.json b/.phase9-state.json
index 2b3e6a4..f8f1c6e 100644
--- a/.phase9-state.json
+++ b/.phase9-state.json
@@ -1,5 +1,8 @@
 {
   "completed_features": [],
-  "current_feature": "webhooks-config",
-  "started_at": "2026-05-23T06:02:21.166704"
+  "current_feature": "two-factor-auth-stub",
+  "started_at": "2026-05-23T06:02:21.166704",
+  "attempted_features": [
+    "webhooks-config"
+  ]
 }
\ No newline at end of file
diff --git a/GENERATION_LOG.md b/GENERATION_LOG.md
index 5eebfdb..7a3802a 100644
--- a/GENERATION_LOG.md
+++ b/GENERATION_LOG.md
@@ -1039,3 +1039,20 @@ src/index.ts(27,25): error TS2769: No overload matches this call.
   Overload 2 of 3, '(plugin: FastifyPluginAsync<{ limits: { fileSize: number; }; }, RawServerDefault, FastifyTypeProvider, FastifyBaseLogger>, opts?: FastifyRegisterOptions<...> | undefined): FastifyInstance<...> & PromiseLike<...>', gave the following error.
     Argument of type 'Promise<FastifyMultipartPlugin>' is not assignable to parameter of type 'FastifyPluginAsync<{ limits: { fileSize: number; }; }, RawServerDefault, FastifyTypeProvider, FastifyBaseLogger>'.
       Type 'Promise<FastifyMultipartPlugin>' provides no match for the signature '(instance: FastifyInstance<RawServerDefault, IncomingMessage, ServerResponse<IncomingMessage>, FastifyBaseLogger, FastifyTy
+- `06:04:08` **INFO**   Committed feature webhooks-config
+- `06:04:08` **INFO**   Pushed: rc=0
+
+## Phase-3 Feature: two-factor-auth-stub (2026-05-23 06:04:08)
+
+- `06:04:08` **INFO** Description: 2FA-Setup-Page (TOTP-Stub, kein realer verify yet)
+- `06:04:08` **INFO**   Generating apps/web/src/pages/TwoFactorAuth.tsx (2FA-Setup-Page. Zeigt fake QR-Code-Placeholder (SVG-Box mit 'QR-Code h…)
+- `06:04:40` **INFO**     wrote 3552 chars in 31.8s (attempt 1)
+- `06:04:40` **INFO** Running tsc --noEmit on api…
+- `06:04:42` **WARN**   tsc errors:
+src/index.ts(27,25): error TS2769: No overload matches this call.
+  Overload 1 of 3, '(plugin: FastifyPluginCallback<{ limits: { fileSize: number; }; }, RawServerDefault, FastifyTypeProvider, FastifyBaseLogger>, opts?: FastifyRegisterOptions<...> | undefined): FastifyInstance<...> & PromiseLike<...>', gave the following error.
+    Argument of type 'Promise<FastifyMultipartPlugin>' is not assignable to parameter of type 'FastifyPluginCallback<{ limits: { fileSize: number; }; }, RawServerDefault, FastifyTypeProvider, FastifyBaseLogger>'.
+      Type 'Promise<FastifyMultipartPlugin>' provides no match for the signature '(instance: FastifyInstance<RawServerDefault, IncomingMessage, ServerResponse<IncomingMessage>, FastifyBaseLogger, FastifyTypeProvider>, opts: { ...; }, done: (err?: Error | undefined) => void): void'.
+  Overload 2 of 3, '(plugin: FastifyPluginAsync<{ limits: { fileSize: number; }; }, RawServerDefault, FastifyTypeProvider, FastifyBaseLogger>, opts?: FastifyRegisterOptions<...> | undefined): FastifyInstance<...> & PromiseLike<...>', gave the following error.
+    Argument of type 'Promise<FastifyMultipartPlugin>' is not assignable to parameter of type 'FastifyPluginAsync<{ limits: { fileSize: number; }; }, RawServerDefault, FastifyTypeProvider, FastifyBaseLogger>'.
+      Type 'Promise<FastifyMultipartPlugin>' provides no match for the signature '(instance: FastifyInstance<RawServerDefault, IncomingMessage, ServerResponse<IncomingMessage>, FastifyBaseLogger, FastifyTy
diff --git a/apps/web/src/pages/TwoFactorAuth.tsx b/apps/web/src/pages/TwoFactorAuth.tsx
new file mode 100644
index 0000000..6a2a018
--- /dev/null
+++ b/apps/web/src/pages/TwoFactorAuth.tsx
@@ -0,0 +1,82 @@
+import React, { useState } from 'react';
+import { useToast } from '../components/Toast';
+
+export default function TwoFactorAuth() {
+  const toast = useToast();
+  const [code, setCode] = useState('');
+  const [secret] = useState('JBSWY3DPEHPK3PXP'); // Mock secret for MVP
+
+  const handleEnable2FA = async (e: React.FormEvent) => {
+    e.preventDefault();
+    if (code.length !== 6) {
+      toast.error('Bitte gib einen 6-stelligen Code ein');
+      return;
+    }
+    
+    // Stub for MVP
+    toast.success('TOTP-Setup-MVP — Verifikation kommt in v2');
+  };
+
+  return (
+    <div className="max-w-md mx-auto py-12 px-4">
+      <div className="bg-white border border-slate-200 rounded-xl shadow-sm overflow-hidden">
+        <div className="px-6 py-4 border-b border-slate-200 bg-slate-50/50">
+          <h1 className="text-xl font-semibold text-slate-800">Zwei-Faktor-Authentifizierung</h1>
+          <p className="text-sm text-slate-500 mt-1">Erhöhe die Sicherheit deines Accounts.</p>
+        </div>
+
+        <div className="p-6 space-y-8">
+          {/* Step 1: QR Code */}
+          <div className="flex flex-col items-center text-center space-y-4">
+            <div className="p-4 bg-slate-100 border-2 border-dashed border-slate-300 rounded-lg">
+              <svg 
+                width="160" 
+                height="160" 
+                viewBox="0 0 100 100" 
+                className="text-slate-400"
+              >
+                <rect x="10" y="10" width="20" height="20" fill="currentColor" />
+                <rect x="70" y="10" width="20" height="20" fill="currentColor" />
+                <rect x="10" y="70" width="20" height="20" fill="currentColor" />
+                <rect x="40" y="40" width="20" height="20" fill="currentColor" />
+                <text x="50" y="60" textAnchor="middle" fontSize="8" className="fill-slate-500 font-medium">
+                  QR-CODE HERE
+                </text>
+              </svg>
+            </div>
+            <div className="space-y-2">
+              <p className="text-sm text-slate-600">Scanne den Code mit deiner Authenticator App (z.B. Google Authenticator oder Authy).</p>
+              <div className="flex items-center justify-center gap-2">
+                <span className="text-xs font-mono bg-slate-100 px-2 py-1 rounded border border-slate-200 text-slate-700 select-all">
+                  {secret}
+                </span>
+              </div>
+              <p className="text-xs text-slate-400">Oder gib den Secret-Key manuell ein.</p>
+            </div>
+          </div>
+
+          {/* Step 2: Verification */}
+          <form onSubmit={handleEnable2FA} className="space-y-4">
+            <div className="space-y-2">
+              <label className="text-sm font-medium text-slate-700">Verifizierungscode</label>
+              <input
+                type="text"
+                maxLength={6}
+                placeholder="000000"
+                value={code}
+                onChange={(e) => setCode(e.target.value.replace(/\D/g, ''))}
+                className="w-full px-3 py-2 border border-slate-300 rounded-md focus:outline-none focus:ring-2 focus:ring-slate-900 focus:border-transparent text-center text-2xl tracking-widest font-mono"
+              />
+            </div>
+            <button
+              type="submit"
+              className="w-full py-2 px-4 bg-slate-900 text-white rounded-md font-medium hover:bg-slate-800 transition-colors"
+            >
+              2FA Aktivieren
+            </button>
+          </form>
+        </div>
+      </div>
+    </div>
+  );
+}
\ No newline at end of file