Drupal forms don't reside in any particular template. They are defined in the code. When a form is displayed, the code is read, it is then made available for modification by other modules before being rendered by a function called drupal_render() this will then use various template files to build the form which its displayed to the user.
It is fairly simple to add a field to the login form using hook_form_alter().
function hook_form_alter(&$form, &$form_state, $form_id) {
if ($form_id == 'user_register') {
$form['myfield'] = array(
'#type' => 'text',
'#title' => t('code'),
);
}
}
What is perhaps more tricky is deciding what to do with this, are you using it for a second form of authentication?
A final note is on where to put the code. Drupal is fairly flexible, in that you can put theme files in modules and functionality in themes. However best practice is to keep features in modules, it leeds to a more manageable system in the long run.