[bordoni]

Admin and Support tools for MFA. Stacked on #89. Part of #28.

Changes

• Settings (WorkOS → Settings → Authentication, per environment): the MFA mode (WordPress decides / WorkOS decides / off) and the roles that must use MFA. Both are sanitized against the known modes and roles.
• User-edit screen: another user's MFA status, a Require checkbox, and Lost authenticator, which removes every factor when the profile is saved.
• Routes: PUT /users/{id}/mfa/required and POST /users/{id}/mfa/reset. Permission is edit_user, or whatever workos_mfa_can_manage_user allows (e.g. a Support role).
• WP-CLI: wp workos mfa status|require|unrequire|reset <user>.
• Diagnostics: a "Two-Step Verification" check. It lists factors for a user that can't exist, so a "not found" answer means the factor API is reachable. It also shows the active mode.

Screenshots

Verified

• New MfaAdminTest (8 tests):
  • Require and clear, reset.
  • An editor is refused, but the filter can grant access.
  • The panel saves the flag and the reset, ignores forms without the panel, and renders only for admins.
  • Settings sanitizing.
• The CLI command is only lint-checked; WP-CLI isn't in the test environment.
• Local WPUnit: 863 tests, same 11 environment-only failures. PHPCS and PHPStan pass.