Thanks for the pointer! I can see an option "Enable database quick unlock (Touch ID / Windows Hello)". It's a bit of a clunky setting though. Ideally I'd like to use quick unlock instead of typing the DB password (e.g. only after session inactivity), but when that setting is checked it also forces you to use it immediately after typing the password.

> and store the OTP code in the app

Oh lord, this is a game-changer.