feat(security): let an operator require a second factor

Wire the previously-unused mfaEnforced flag into a real policy. An admin can
require a second factor instance-wide (an AppSettings toggle in the General
section) or per user (a toggle in user management); the effective requirement is
the OR of the two. When required and the account has no active factor — no
confirmed TOTP, no registered security key, and no primary passkey — the user is
walled behind a forced-enrollment interstitial after sign-in, with only the
security settings and sign-out reachable until a factor is enrolled.

The gate is surfaced like the onboarding gate: a hint cookie the proxy reads
without a DB round-trip, recomputed from the database on every sign-in and on
/api/auth/me so a tampered cookie self-corrects. Nobody is locked out — the
enrollment surface stays reachable, and toggling the policy off (or the
disable-mfa CLI) is the operator's recovery path.

src/components/admin/user-management-section.tsx

@@ -2,7 +2,15 @@
 
 import { useMemo, useState } from "react";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { KeyRound, Loader2, LogOut, Pencil, Shield, Users } from "lucide-react";
+import {
+  KeyRound,
+  Loader2,
+  LogOut,
+  Pencil,
+  Shield,
+  ShieldCheck,
+  Users,
+} from "lucide-react";
 import { toast } from "sonner";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
@@ -177,6 +185,31 @@ export function UserManagementSection() {
         <Shield className="h-3 w-3" aria-hidden="true" />
         {u.role === "ADMIN" ? t("admin.toUser") : t("admin.toAdmin")}
       </Button>
+      <Button
+        variant="ghost"
+        size="sm"
+        className={`min-h-11 min-w-11 px-3 text-xs ${u.mfaEnforced ? "text-dracula-green" : ""}`}
+        onClick={() =>
+          updateUser.mutate({
+            id: u.id,
+            data: { mfaEnforced: !u.mfaEnforced },
+          })
+        }
+        title={
+          u.mfaEnforced
+            ? t("admin.mfaEnforcedOnHint")
+            : t("admin.mfaEnforcedOffHint")
+        }
+        aria-label={
+          u.mfaEnforced
+            ? t("admin.mfaEnforcedOnHint")
+            : t("admin.mfaEnforcedOffHint")
+        }
+        aria-pressed={u.mfaEnforced}
+      >
+        <ShieldCheck className="h-3 w-3" aria-hidden="true" />
+        {u.mfaEnforced ? t("admin.mfaEnforcedOn") : t("admin.mfaEnforcedOff")}
+      </Button>
       <Button
         variant="ghost"
         size="sm"