Reset MFA settings by user ID

Disables the target user's two-factor authentication state by setting the twoFactorAuthEnabled, authAppEnabled, and backupCodesEnabled user-settings flags to false. The next time the user logs in they will be prompted to set 2FA up again from scratch. Use this when a user has lost access to their authenticator device or backup codes — note that this temporarily reduces their account security until re-enrolment.

Gated by the security:passwordPolicy:resetTwoFactor system setting; if reset is disabled at the deployment level, the call returns 400. Callers can reset their own MFA, or another user's if they are a subgroup admin, system admin, or elabadmin.