feat(security): let an operator require a second factor

Wire the previously-unused mfaEnforced flag into a real policy. An admin can
require a second factor instance-wide (an AppSettings toggle in the General
section) or per user (a toggle in user management); the effective requirement is
the OR of the two. When required and the account has no active factor — no
confirmed TOTP, no registered security key, and no primary passkey — the user is
walled behind a forced-enrollment interstitial after sign-in, with only the
security settings and sign-out reachable until a factor is enrolled.

The gate is surfaced like the onboarding gate: a hint cookie the proxy reads
without a DB round-trip, recomputed from the database on every sign-in and on
/api/auth/me so a tampered cookie self-corrects. Nobody is locked out — the
enrollment surface stays reachable, and toggling the policy off (or the
disable-mfa CLI) is the operator's recovery path.

src/components/admin/general-settings-section.tsx

@@ -43,6 +43,19 @@ export function GeneralSettingsSection() {
           disabled={updateSettings.isPending}
         />
 
+        {/* v1.23 — instance-wide "require a second factor" policy. Every
+            account without an active factor is sent to forced enrollment after
+            sign-in. */}
+        <SettingsToggle
+          label={t("admin.mfaRequired")}
+          description={t("admin.mfaRequiredDescription")}
+          checked={settings?.mfaRequired ?? false}
+          onCheckedChange={(checked) =>
+            updateSettings.mutate({ mfaRequired: checked })
+          }
+          disabled={updateSettings.isPending}
+        />
+
         {/* v1.4.27 MB7 / CF-56 — match the SettingsToggle stacking
             contract: stack on `<sm`, side-by-side on `sm+`. */}
         <div className="flex flex-col gap-2 sm:flex-row sm:items-center sm:justify-between">