2.0: Store guard settings in DB + admin UX polish (update-safe config)

Phuong an A (modification 20260728T055053, ADR plugin-manager_extension-update-flow #7):
- Guard settings (enabled/forced + qr/recovery/window) are now read/written via
  admin_config through mfa_* helpers in function.php, overlaid on config.php
  defaults. A 1-click plugin update overwrites files but preserves admin_config,
  so the site owner's settings are no longer reset. config.php keeps dev-level
  defaults (model, redirects). mfa_is_user_enrolled aligned to mfa_get_guard_config.
- MfaDashboard: settings become an editable form (save() writes admin_config,
  authorizeAction + validate); dashboard.blade converted to that form.

Admin UX (post-migration follow-ups):
- Dashboard: always show Forced status per guard (on/off), enabled-state card
  colouring (safelisted classes), configuration guide section.
- Users: select any account type whose model exists (not only enabled guards);
  three-state MFA status (Enabled/Pending/Not setup); reset offered whenever a
  record exists (incl. abandoned setup); badge icon/text spacing (gap-1);
  removed duplicate toast (layout already renders one).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>