👾 Multi-step configurable MFA methods

Each VPN location can now be configured with a multi-step MFA flow —
an ordered sequence of authentication factors a user must complete.

MFA flows are first-class shared entities: a flow is a named ordered list
of MFA steps, reusable across locations. Group scoping and ordering live
on the location as an ordered assignment list:

Location → ordered list of (group-set → flow) assignments
Flow → ordered list of (method-set) steps

Flow resolution is total and deterministic: at connect time, the server
resolves a user against the location's assignment list in order (first
match wins). A mandatory default assignment (empty group set, matches
everyone) guarantees no user ever falls through.

No configuration is ever blocked for "conflicting" flows — ordered
first-match makes every save valid.