Security login layered system

Implement a layered login security system for the website. First, allow normal login via email password or Google sign-in. After successful authentication, check if the device is trusted. If it is new or unused within a configurable period (e.g. 60 days) generate a one-time verification code and send it to the user's verified email via SMTP. The email should include time, approximate location, and browser info. Once the correct code is entered, mark that device as trusted in the database. For trusted devices, only require re-verification if high-risk signals appear, such as a different country, a new browser, or repeated failed login attempts. Also, add an admin setting to configure trusted device expiry, email alerts for suspicious logins, and IP logging with an optional whitelist enforcement for admins. Also integrate rate limiting and temporary account lockouts for brute-force protection."