Signal TOTP/U2F change to other devices

[sveniu]

It's unclear how TOTP/U2F changes propagate to other devices: There are instances when TOTP was disabled using rushpath, but still showed up as enabled in the Windows desktop app.

Some things to investigate:

• The docs say (and apps do) re-encrypt the backup on MFA changes. It's unclear why this is a requirement, but it might act as a signalling mechanism, possibly together with the use of timestamps.
• The use of the authentication/changeOfPasswordDone API after MFA changes.