v1.9.0

Multisite: network-only, with a guided dependency

• On multisite the plugin is now network-only — per-site activation is refused with a "must be Network Activated" notice (admin UI + WP-CLI).
• Two dependency notices: an actionable Network Admin notice (one-click install + network-activate Two Factor) and a per-site heads-up on sites where Two Factor isn't loaded.
• The one-click installer network-activates Two Factor and checks install_plugins + manage_network_plugins independently.

Self-hosted updates from GitHub Releases

• Installed sites now receive updates straight from this repo's Releases via Plugin Update Checker (vendored and pinned in-repo). The Update URI header also prevents any same-slug WordPress.org plugin from hijacking updates.
• This release ships the first force-email-two-factor.zip asset, so 1.9.0 → future versions auto-update.

Copy & docs

• Harmonized dependency-notice wording ("The Require Email 2FA plugin is not enforcing email 2FA…"); new FAQ on expired email codes.

Security / CI

• Release pipeline is a pure `git archive` of reviewed, in-repo bytes (no release-time Packagist resolution); CI Actions pinned by SHA; real-multisite E2E added to CI.