Add an Emailed Code Option to Multi-Factor Authentication

Multi-factor authentication now takes an emailed one-time code as well as an authenticator app. Not everyone on the floor has an authenticator app, and setting one up is a real barrier for shared or occasional accounts — so enrollment now offers the choice, email-enrolled users get a matching sign-in challenge, and admins control who is allowed to use it. It's off by default; an admin turns it on for the shop.