2.4.0

feat: trusted devices, per-guard MFA session, verify throttle (2.4.0)

Trusted devices: when entering the authenticator code a user may tick
"Trust this device for N days" (default 30, 0-365 per guard, 0 = off).
That browser then skips the code on later sign-ins of the same account and
guard; the password is always required. Only a SHA-256 of the token is
stored (table mfa_trusted_devices); the cookie is encrypted, HttpOnly and
follows the session cookie settings. Trust is revoked on any password
change, turning MFA off, an admin reset, or a recovery-code sign-in; users
can remove devices on the MFA manage page.

Security hardening:

• the "MFA passed" session mark is bound to the guard and the account;
• the web verify screen allows 5 wrong codes per 15 minutes per account
  and shares the code replay protection with REST API v2;
• the session id is regenerated after the second factor.

Config: the vendor guard uses the MultiVendor VendorUser model; the sample
pmo_partner guard, the unused session_lifetime key and URL guard sniffing
are removed. update() creates the new table and moves vendor enrolments
saved under the old class name. Requires gp247/core 3.5.1+.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com