feat: self-hosted env flag to require MFA for every dashboard user #5025

Is your feature request related to a problem? Please describe.

Self-hosted instances can't require multi-factor authentication. TOTP MFA is opt-in for each user, magic-link login is always available, and users can turn MFA off themselves. Operators under compliance programs (FedRAMP, SOC 2, HIPAA) need to require a second factor for every dashboard user, not just recommend one.

Describe the solution you'd like to see

An opt-in MFA_REQUIRED webapp env var, off by default. When it's set:

• A signed-in user without MFA is sent to a setup page. Other dashboard requests are refused until they enable it.
• Users can't disable MFA.

Describe alternate solutions

• Put an authenticating proxy (such as OIDC at the load balancer) in front of the dashboard. This adds infrastructure, and the MFA it enforces sits outside Trigger.dev.
• Report users without MFA and follow up with them manually. This catches gaps but doesn't prevent access.

Additional information

I have an implementation ready and will open a PR that references this issue.