- verification: VerificationFactor.strength strong|weak (default weak —
  email code alone is not 2FA), describe()/strong_names()/strong_factors()
- users: password_change_required + mfa_enrollment_required flags,
  auth_type 'login' (org-provisioned), StapelUsernameValidator — exactly
  one '/' as org-namespace separator (org_slug/local); migration 0009
  expand-only; hosts with their own concrete user run makemigrations
- workspaces consumer: require_capability() over workspaces.check_capability
  (30s cache, fail-closed on remote error, degrade to membership+builtin
  role table on old workspaces)

1897 tests (+41), ruff clean, migration-lint clean, wheel verified.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>