feat(security): let an operator require a second factor

Wire the previously-unused mfaEnforced flag into a real policy. An admin can
require a second factor instance-wide (an AppSettings toggle in the General
section) or per user (a toggle in user management); the effective requirement is
the OR of the two. When required and the account has no active factor — no
confirmed TOTP, no registered security key, and no primary passkey — the user is
walled behind a forced-enrollment interstitial after sign-in, with only the
security settings and sign-out reachable until a factor is enrolled.

The gate is surfaced like the onboarding gate: a hint cookie the proxy reads
without a DB round-trip, recomputed from the database on every sign-in and on
/api/auth/me so a tampered cookie self-corrects. Nobody is locked out — the
enrollment surface stays reachable, and toggling the policy off (or the
disable-mfa CLI) is the operator's recovery path.

src/components/admin/_shared.tsx

@@ -26,6 +26,8 @@ export interface AdminUser {
   email: string | null;
   role: string;
   createdAt: string;
+  // v1.23 — per-user "require a second factor" override.
+  mfaEnforced: boolean;
   passkeyCount: number;
 }
 
@@ -65,6 +67,8 @@ export interface SystemStatus {
 
 export interface AdminSettings {
   registrationEnabled: boolean;
+  // v1.23 — instance-wide "require a second factor" policy.
+  mfaRequired: boolean;
   defaultLocale: string;
   telegramGlobal: boolean;
   ntfyGlobal: boolean;