#29: add reset-mfa, so a broken enrolment does not cost the mailbox

An enrolment can end up confirmed against a secret the authenticator no longer
holds - the account is then locked behind codes nobody can produce, and the
only documented recovery was a DELETE against mfa_totp. That SQL was also
incomplete: it left the recovery codes valid and the sessions live.

reset-mfa removes the authenticator secrets and the recovery codes, and signs
the account's sessions out, because a live session would keep the console open
without the factor that was just removed. The password is untouched, so the
command alone grants nobody access.

The alternative people reach for - delete the mailbox and create it again -
takes its mail, folders and aliases with it, and none of those are the problem.
The docs now say so.

Also corrects the advice printed after create-admin, which still told the
operator to enrol from the webmail settings before the console would open. The
console has enrolled inline since #23.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Makefile

@@ -1,4 +1,4 @@
-.PHONY: up down logs test lint migrate-up migrate-down gen-dev-cert seed preflight create-admin reset-password
+.PHONY: up down logs test lint migrate-up migrate-down gen-dev-cert seed preflight create-admin reset-password reset-mfa
 
 # Local development builds from source; production pulls what CI published.
 up:
@@ -56,3 +56,11 @@ reset-password:
 	@test -n "$(EMAIL)" || (echo "EMAIL is required" && exit 1)
 	@test -n "$(PASSWORD)" || (echo "PASSWORD is required" && exit 1)
 	docker compose run --rm --entrypoint node auth dist/cli.js reset-password "$(EMAIL)" "$(PASSWORD)"
+
+# Clears every second factor from an account: the lost-phone case, and the one
+# where an enrollment was confirmed against a secret the authenticator does not
+# have. The password is untouched, so this alone grants nobody access.
+#   make reset-mfa EMAIL=you@example.com
+reset-mfa:
+	@test -n "$(EMAIL)" || (echo "EMAIL is required" && exit 1)
+	docker compose run --rm --entrypoint node auth dist/cli.js reset-mfa "$(EMAIL)"