Configurable VPN MFA session timeout

`VPN_MFA_SESSION_TIMEOUT` is a hard-coded 10-minute const in `crates/defguard_common/src/db/models/vpn_client_mfa_session.rs`. Issue #3043 asked for an administrator-configurable value and called it location-level, but 2.2 moved MFA configuration onto mfa_flow, so the scoping decision - per-flow, per-location, or a global setting - has to come first. Needs a migration, an API surface, and UI.