feat(security): let an operator require a second factor

Wire the previously-unused mfaEnforced flag into a real policy. An admin can
require a second factor instance-wide (an AppSettings toggle in the General
section) or per user (a toggle in user management); the effective requirement is
the OR of the two. When required and the account has no active factor — no
confirmed TOTP, no registered security key, and no primary passkey — the user is
walled behind a forced-enrollment interstitial after sign-in, with only the
security settings and sign-out reachable until a factor is enrolled.

The gate is surfaced like the onboarding gate: a hint cookie the proxy reads
without a DB round-trip, recomputed from the database on every sign-in and on
/api/auth/me so a tampered cookie self-corrects. Nobody is locked out — the
enrollment surface stays reachable, and toggling the policy off (or the
disable-mfa CLI) is the operator's recovery path.

src/lib/validations/admin.ts

@@ -8,6 +8,8 @@ import { isPublicUrl } from "@/lib/validations/notifications";
 export const adminSettingsSchema = z
   .object({
     registrationEnabled: z.boolean().optional(),
+    // v1.23 — instance-wide "require a second factor" policy.
+    mfaRequired: z.boolean().optional(),
     defaultLocale: z.enum(["de", "en"]).optional(),
     telegramGlobal: z.boolean().optional(),
     ntfyGlobal: z.boolean().optional(),