Allow coulomb-social ordinary login at AAL1 via mfaRequired: false while keeping provider requireForAll for clients without an override. Preserve explicit acr_values=aal2 for step-up.