feat: enable/disable TFA per user

server/graph/schemas/user.graphql

@@ -78,6 +78,14 @@ type UserMutation {
     id: Int!
   ): DefaultResponse @auth(requires: ["manage:users", "manage:system"])
 
+  enableTFA(
+    id: Int!
+  ): DefaultResponse @auth(requires: ["manage:users", "manage:system"])
+
+  disableTFA(
+    id: Int!
+  ): DefaultResponse @auth(requires: ["manage:users", "manage:system"])
+
   resetPassword(
     id: Int!
   ): DefaultResponse
@@ -130,6 +138,7 @@ type User {
   providerKey: String!
   providerName: String
   providerId: String
+  providerIs2FACapable: Boolean
   isSystem: Boolean!
   isActive: Boolean!
   isVerified: Boolean!