feat(security): workspace-level mfa enforcement — require all members to set up totp

[AndreLiar]

User story

As a workspace admin, I want to require MFA for all members of my workspace so that no one can access compliance data without a second factor — without having to individually verify each person's settings.

Current state

MFA (TOTP) exists and works: each user can enable it voluntarily in Settings → Security. But there is no enforcement mechanism — members who skip it still have full access.

Expected behaviour

1. Admin toggle (Settings → Team or Security): "Require two-factor authentication for all members"
2. When toggled ON:
   • Members who already have MFA enabled: no change
   • Members who don't have MFA enabled: on next login (or next page load), they are redirected to an interstitial page: "Your organization requires MFA. Set it up now to continue." — dashboard is inaccessible until they complete setup
3. When toggled OFF: gate removed, members can access dashboard regardless of MFA status

Implementation plan

Backend

• Add mfaRequired: Boolean field to Workspace model (default false)
• Add PATCH /api/v1/workspaces/:id/settings endpoint (owner only) to toggle mfaRequired
• Add middleware requireWorkspaceMfa: after workspaceAuth, if workspace.mfaRequired && !req.user.mfaEnabled → return 403 { code: 'MFA_REQUIRED' }
• Apply this middleware to all protected workspace routes (rag, assessments, questionnaires, conversations)

Frontend

• Admin toggle: in workspace team settings, show "Require MFA" switch (visible to owner role only)
• Interstitial gate: in the dashboard layout, after workspace loads, if workspace.mfaRequired && !user.mfaEnabled → render a full-screen prompt with the MFA setup form (same MfaSection component) instead of the dashboard. Block navigation until MFA is enabled.
• API 403 handler: if any API call returns { code: 'MFA_REQUIRED' }, redirect to the interstitial gate

Login flow note

The gate is enforced at the dashboard layout level (client-side) + middleware level (API). No changes needed to the login/JWT flow itself.

Acceptance criteria

• Admin can enable/disable MFA enforcement per workspace
• Member without MFA who tries to access the dashboard sees the setup prompt, not the dashboard
• Member completes MFA setup → is immediately granted access (no re-login needed)
• Admin disabling enforcement → members without MFA regain access immediately
• Non-owner members cannot see or change the enforcement toggle