🧢 Post-enrolment MFA configuration #2910

As a user, I want to configure MFA in the desktop client when connecting to an MFA-protected location, so that I can access protected resources without re-enrolling the whole instance.

Methods we will configure:

• Authenticator
• Email
• Mobile Biometry

Acceptance Criteria

• When a user without configured MFA attempts to connect to an MFA-protected location, the client detects the missing MFA configuration.
• The client prompts the user to configure MFA directly in the application.
• After successful MFA configuration, the user can connect without re-enrolling the instance.
• Existing enrolled instances do not need to be removed and added again.
• The flow supports users with the Enrolled status.
• The user needs to confirm the operation with a factor he already has configured. The user can pick a factor to confirm the operation.
• If the user does not have any factors configured we use email code to verify the operation. In that case Email factor is automatically configured.