Mejora
Admin MFA can be turned on after enrol
Admin two-factor is off until ADMIN_MFA_ENFORCE is set, so the only admin can enrol first.
Admin can sign in and enrol MFA before enforcement is switched on. Missing step-up, reveal, or impersonation secrets now disable only that feature instead of blocking the whole admin area.