Improve the re-authentication experience on portal

**Problem**
Users who signed up with Google cannot perform re-authentication. They were blocked from performing sensitive operations, like revealing a secret.

**Appetite**
2 weeks.

**Solution**
After Workflow is shipped

- If the user has means to re-authenticate, require them to re-authenticate before performing sensitive operations.
- If the user has no means to re-authenticate, show a message to ask them to set up 2FA. After that, they can re-authenticate.

**Rabbit holes**
The user who set up 2FA for this reason has to perform 2FA when they sign in.

**No-goes**
Not applicable.

Start by tracing the portal flow for sensitive operations and how users who signed up with Google currently reach re-authentication. Review the existing 2FA setup and sign-in paths before implementing the stated behavior: require re-authentication when available, or guide users without a method to set up 2FA, then verify both paths.

Written by the indexing model from the issue text.