KEY-WP-0008: honor per-client mfaRequired and acr_values step-up

Allow coulomb-social ordinary login at AAL1 via mfaRequired: false while
keeping provider requireForAll for clients without an override. Preserve
explicit acr_values=aal2 for step-up.

src/internal/config/config.go

@@ -39,6 +39,7 @@ type ClientConfig struct {
 	ServiceSubject string   `yaml:"serviceSubject,omitempty"`
 	Tenant         string   `yaml:"tenant,omitempty"`
 	Roles          []string `yaml:"roles,omitempty"`
+	MFARequired    *bool    `yaml:"mfaRequired,omitempty"`
 }
 
 // Load reads and parses the YAML config file at path.