Support opt-in MFA per browser client with authoritative enrollment checks

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

src/internal/config/config.go

@@ -61,6 +61,7 @@ type ClientConfig struct {
 	Tenant          string   `yaml:"tenant,omitempty"`
 	Roles           []string `yaml:"roles,omitempty"`
 	TokenLifetime   string   `yaml:"tokenLifetime,omitempty"`
+	MFAOptional     bool     `yaml:"mfaOptional,omitempty"`
 	MFARequired     *bool    `yaml:"mfaRequired,omitempty"`
 	RegistrationURL string   `yaml:"registrationUrl,omitempty"`
 	EnrollmentURL   string   `yaml:"enrollmentUrl,omitempty"`
@@ -130,6 +131,7 @@ func (c *Config) Registrations() ([]domain.Client, error) {
 			Roles:           cc.Roles,
 			TokenLifetime:   lifetime,
 			MFARequired:     cc.MFARequired,
+			MFAOptional:     cc.MFAOptional,
 			RegistrationURL: cc.RegistrationURL,
 			EnrollmentURL:   cc.EnrollmentURL,
 		})