KEY-WP-0008: honor per-client mfaRequired and acr_values step-up

Allow coulomb-social ordinary login at AAL1 via mfaRequired: false while
keeping provider requireForAll for clients without an override. Preserve
explicit acr_values=aal2 for step-up.

src/cmd/keycape/main.go

@@ -273,6 +273,7 @@ func buildClientRegistry(cfgClients []config.ClientConfig) (map[string]*domain.C
 			ServiceSubject: c.ServiceSubject,
 			Tenant:         c.Tenant,
 			Roles:          c.Roles,
+			MFARequired:    c.MFARequired,
 		}
 	}
 	return m, nil