feat(web): add MFA login prompt and security settings UI

Handle MFA challenge in login flow (TOTP code input after password
verification, recovery code hint, back navigation). Add admin security
settings section with session idle timeout, max sessions per user,
MFA policy selector, SSO enforcement toggle with break-glass username,
and password policy controls. Propagate new i18n keys to all 21 locales.

apps/web/src/hooks/use-auth.ts

@@ -7,6 +7,7 @@ interface AuthState {
   authEnabled: boolean;
   isAuthenticated: boolean;
   mustChangePassword: boolean;
+  mfaRequired: boolean;
   role: string | null;
   permissions: string[];
   analyticsEnabled: boolean | null;
@@ -44,6 +45,7 @@ export function useAuth() {
     authEnabled: false,
     isAuthenticated: false,
     mustChangePassword: false,
+    mfaRequired: false,
     role: null,
     permissions: [],
     analyticsEnabled: null,
@@ -73,6 +75,7 @@ export function useAuth() {
               authEnabled: false,
               isAuthenticated: true,
               mustChangePassword: false,
+              mfaRequired: false,
               role: "admin",
               permissions: ANON_ADMIN_PERMISSIONS,
               analyticsEnabled: null,
@@ -104,6 +107,7 @@ export function useAuth() {
               authEnabled: true,
               isAuthenticated: true,
               mustChangePassword: mustChange,
+              mfaRequired: session.user?.mfaRequired === true,
               role: session.user?.role ?? null,
               permissions: session.user?.permissions ?? [],
               analyticsEnabled: session.user?.analyticsEnabled ?? null,
@@ -125,6 +129,7 @@ export function useAuth() {
               authEnabled: true,
               isAuthenticated: false,
               mustChangePassword: false,
+              mfaRequired: false,
               role: null,
               permissions: [],
               analyticsEnabled: null,