feat: require_mfa setting and user_mfa ciphertext mirror

backup/verify.go

@@ -128,6 +128,7 @@ func probe(ctx context.Context, opt VerifyOptions, rep *VerifyReport) error {
 //	secrets          - models/secret.go: encrypted_value
 //	auth_providers   - models/auth_provider.go: client_secret_enc
 //	console_sessions - models/console_session.go: rdp_user_enc, rdp_pass_enc
+//	user_mfa         - models/user_mfa.go: totp_secret_enc
 //
 // settings is deliberately absent: it holds no ciphertext at all. The ESO read
 // token is stored as a SHA-256 hash, which no key opens.
@@ -136,6 +137,7 @@ var ciphertextFields = map[string][]string{
 	"secrets":          {"encrypted_value"},
 	"auth_providers":   {"client_secret_enc"},
 	"console_sessions": {"rdp_user_enc", "rdp_pass_enc"},
+	"user_mfa":         {"totp_secret_enc"},
 }
 
 func findCiphertext(ctx context.Context, db *mongo.Database, coll string) (string, bool, error) {