The framework interfaces\auth\user contract previously expected MFA
state to be exposed as public properties on the concrete implementation,
which forced consumers (oauth-server's requireMfaResponse) to type-pun
against an interface that didn't declare them. PHPStan level 5 surfaced
this as Access to an undefined property errors. The trait already had
$mfaRequired / $mfaConfigured properties; this commit promotes them
into the contract via getMfaRequired()/getMfaConfigured() accessors so
downstream services can reach them through the interface.

Test fixtures that implement the user interface inline (AuthUserTest)
gain the two new methods.