Mejoras
Admin MFA and audited mutations
Admins now enrol TOTP or a passkey, and sensitive admin actions need a reason, step-up, and an audit row.
Platform admins get an Admin account page for TOTP and passkeys. Other /admin and /api/admin routes require AAL2. Credit grants, role changes, and IP blocks need step-up plus a reason, and write through audited helpers. View-as is read-only with an orange timer banner. Dedicated production secrets no longer fall back to the service role.