update docs

docs/thijooree/10-otp-screen.md

@@ -0,0 +1,62 @@
+# OTP Screen
+
+Displays the current TOTP (Time-based One-Time Password) code for each enrolled bank authenticator. Used when confirming transfers, QR payments, or other 2FA-protected operations.
+
+---
+
+## Fragment — `OtpFragment`
+
+Hosts one card per enrolled bank authenticator. Banks with no stored TOTP seed are not shown.
+
+---
+
+## TOTP Display
+
+Each card shows:
+- Bank logo and name
+- The current 6-digit TOTP code (large text)
+- A circular countdown ring showing time remaining in the current 30-second window
+- The code refreshes automatically when the window expires — no user interaction needed
+
+### Algorithm
+
+Standard RFC 6238 TOTP:
+- Hash: SHA-1
+- Window: 30 seconds
+- Digits: 6
+- Seed: stored per-bank in `CredentialStore` (encrypted)
+
+---
+
+## Supported Banks
+
+| Bank | Seed source |
+|---|---|
+| BML | Enrolled via BML app setup; seed stored in `CredentialStore` |
+| MIB | MIB business/corporate OTP seed (if applicable) |
+
+---
+
+## Background Name Refresh
+
+When the screen opens, the fragment may fire a background API call to refresh the account holder name associated with each seed. This is a best-effort call — failure does not affect OTP display.
+
+---
+
+## Usage
+
+The OTP screen is informational — the user copies the displayed code manually and enters it wherever required (e.g., in `TransferFragment`'s OTP dialog, or in an external portal). The code is never submitted automatically from this screen.
+
+---
+
+## Security
+
+The TOTP seeds are stored encrypted in `CredentialStore`. They are never logged or included in error reports.
+
+---
+
+ 
+
+---
+
+[← Activities](09-activities.md)     **Next →** [PayMV QR Screen](11-paymv-qr-screen.md)