Small gaps from the Color Me Fun simulation: a rate limit per form, CSV export of a filtered list, MFA required for a role

Found by simulating a Claude Code build of Color Me Fun 2026 through the barako CLI (epic #801) on 14 September 2026; the event registration app for the Rotary Club of Koronadal is the acceptance test. Simulation page: https://claude.ai/code/artifact/05afda1a-6461-431d-aff0-50b30d3b0778

Three smaller gaps the simulation hit, each its own small change:

- **A rate limit per public form or lookup.** Limits today are global per IP plus fixed named policies (`auth`, `telemetry`, `registration`). A busy event form and a status lookup need their own, configurable per definition.
- **CSV export of a filtered list.** The shirt size report is one filtered list as CSV. Portability exports the whole tenant; there is no export of `GET /api/contents` with its filters.
- **MFA required for a role.** Color Me Fun makes TOTP mandatory for every organizer. A role cannot require a second factor today, so an organizer can use the dashboard without one.

## Done when

- A form's own rate limit refuses the 21st submission per minute from one address while other endpoints are unaffected.
- `GET /api/contents?contentType=registration&filter...` with `Accept: text/csv` returns the filtered rows, sensitive fields masked as they are in JSON.
- A user holding a role that requires MFA and not enrolled is sent to enrolment at sign-in and cannot use the role until enrolled.

Start by tracing the existing named rate-limit policies and the GET /api/contents endpoint, then inspect the sign-in and role/MFA flow. Use the three “Done when” cases as acceptance checks: per-form limits must not affect other endpoints, CSV must preserve filtering and masking, and roles requiring MFA must block unenrolled users.

Written by the indexing model from the issue text.