feat: Add group policies, method management, and a safer MFA flow

[hellopablo]

Summary

• Adds per-group MFA policies, enrolled methods, and a /mfa/manage screen with setup, resend, and trusted-device handling.
• Hardens login/logout so invalid cookies fail closed, live tokens are reused instead of minting until lockout, and flash errors survive a failed challenge.
• Extends drivers with user-facing setup copy and resend(), plus console commands and admin tabs for group/user MFA.

Test plan

• Run module tests (vendor/bin/phpunit)
• Enable email and authenticator, set a group to required, and complete login + setup
• Confirm a single enabled driver skips the chooser, resend keeps the current token, and logout clears MFA cookies
• Check /mfa/manage layout, last-method removal under a required policy, and the group MFA tab in admin

Made with Cursor