feat: add MFA types, hooks, and APP_MFA_REQUIRED interceptor

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ui/src/types/api.ts

@@ -97,6 +97,7 @@ export interface TenantSettings {
   status: string;
   serverEndpoint: string | null;
   createdAt: string;
+  mfaRequired?: boolean;
 }
 
 // SSO connector types
@@ -200,3 +201,18 @@ export interface TenantMetricsEntry {
   serverState: string;
   metrics: MetricsSummary | null;
 }
+
+// MFA types
+export interface MfaStatus {
+  enrolled: boolean;
+  hasBackupCodes: boolean;
+}
+
+export interface MfaSetupResponse {
+  secret: string;
+  secretQrCode: string;
+}
+
+export interface BackupCodesResponse {
+  codes: string[];
+}