feat: Add group policies, method management, and a safer MFA flow

[hellopablo]

Summary

• Mirrors group policies, method management, console commands, and the revised setup/verification flow from feature/pre-new-admin onto develop.
• Uses develop's class-based Auth permission identifiers for the injected user and group tabs.
• Includes token reuse, bounded resend, malformed-cookie handling, logout invalidation, and the redesigned /mfa/manage UI.

Original feature/pre-new-admin PR: #8.
Depends on nails/module-auth's group-tab develop PR.

Test plan

• PHP syntax checks pass for all changed PHP files
• PHPUnit: 10 tests, 10 assertions
• Re-run PHPStan after the module-auth develop dependency is merged (local analysis currently resolves the published pre-change develop dependency and cascades on the new interface)
• Exercise required/optional policies, setup, resend, logout, and /mfa/manage

Made with Cursor