Security: MFA and session policy per role and per tenant, checked at token issue

Whether a second factor is needed is decided by the account, not by what it can reach. Login challenges for MFA only when the user has enrolled (`barakoCMS/Features/Auth/Login/Endpoint.cs:210`). There is no way to require MFA for a role or a tenant, and session length is one setting for the whole deployment.

### Why it is too specific

It fits a site where security is each person's choice. A clinic must require MFA for anyone who can see patient notes; an event organiser wants it for the cashier role (#813); an agency wants a stricter session length on one client's tenant than another's. Today an admin can only ask people to enrol.

### The general concept

A policy per tenant and per role (require MFA, maximum session length, allowed sign-in methods) evaluated when a token is issued. A caller whose roles in that tenant require MFA and who has not enrolled gets an enrolment challenge instead of a token. The strictest applicable policy wins.

### Where it lives

Core auth: token issuing, MFA and roles.

### Compatibility

Additive. No policy set means today's behaviour. A policy that newly requires MFA changes the login answer only for affected users, using the existing `RequiresMfa` response shape plus an enrol step.

Part of the decision on what a principal is, linked from the umbrella issue. Relates #813.

### Done when

- A user holding a role that requires MFA, without MFA enrolled, is not issued a token and is asked to enrol, with a test that fails before the change.
- The same user in a tenant where the role does not require it signs in as today.
- A tenant session length shorter than the deployment's shortens that tenant's refresh lifetime.

Found in the architecture sweep of 15 September 2026.

Start at barakoCMS/Features/Auth/Login/Endpoint.cs:210 and trace token issuing, MFA, roles, and tenant handling. Define how the strictest applicable role or tenant policy is evaluated before issuing a token, while preserving the no-policy behavior. Add the failing test described in the issue and verify MFA enrolment, tenant-specific role behavior, and shortened refresh lifetimes.

Written by the indexing model from the issue text.