docs(security): note that required-MFA prompts but does not wall the API

The "Require a second factor" policy redirects web users to enrollment but does
not block direct API or native (Bearer) access for an account that has not yet
enrolled — a deliberate lockout-safety choice. Make that explicit: spell it out
in the admin toggle description, add a code comment at the toggle, and add an
operator runbook (docs/ops/mfa-enforcement.md) describing the boundary.

src/components/admin/general-settings-section.tsx

@@ -45,7 +45,9 @@ export function GeneralSettingsSection() {
 
         {/* v1.23 — instance-wide "require a second factor" policy. Every
             account without an active factor is sent to forced enrollment after
-            sign-in. */}
+            sign-in. This is a web-session nudge, not an API wall: direct API /
+            native (Bearer) access for a not-yet-enrolled account is not blocked.
+            See docs/ops/mfa-enforcement.md. */}
         <SettingsToggle
           label={t("admin.mfaRequired")}
           description={t("admin.mfaRequiredDescription")}