Pass a 2FA challenge (+ password?) before activating it

Check the use know what he is doing before being locked out of his own CMS. All the websites I tryed asked me to pass a 2FA challenge before finishing the enabling process: Github, Discord...

Start by locating the Grav Admin 2FA activation flow and any existing challenge or password verification handling; the issue does not name files or tests. Done means enabling 2FA requires a successful 2FA challenge, with password confirmation if the project’s flow supports it, before the user can be locked out.

Written by the indexing model from the issue text.