Two-factor is switched off — testing mode (PANEL_REQUIRE_2FA=0). Passwords alone get in. Remove that setting and restart before this is used for real.