fix: gate second factors after SSO/LDAP behind an admin setting

src/ui/locales/en.json

@@ -2884,6 +2884,8 @@
     "allowPasswordLoginDesc": "Username/password login",
     "oidcAutoProvision": "OIDC Auto-Provision",
     "oidcAutoProvisionDesc": "Auto-create accounts for OIDC/SSO users on first login (independent of the registration toggle)",
+    "secondFactorAfterExternalLogin": "Ask for a second factor after external logins (SSO, GitHub, Google, LDAP)",
+    "secondFactorAfterExternalLoginDesc": "Off, an enrolled second factor is only asked for after password and other local logins, same as before. On, it is asked for after every login method, including SSO and LDAP.",
     "oidcSilentLoginDefault": "Silent OIDC Login by Default",
     "oidcSilentLoginDefaultDesc": "Automatically redirect to OIDC login on every visit, skipping the login form entirely",
     "oidcSilentLoginDefaultLockedDesc": "This setting is locked by the OIDC_SILENT_LOGIN_DEFAULT environment variable and cannot be changed here.",
@@ -3054,6 +3056,7 @@
     "updatePasswordLoginFailed": "Failed to update password login setting",
     "cannotDisablePasswordLoginWithTotp": "Cannot disable password login while 2FA is enabled for one or more users. Disable 2FA first.",
     "updateOidcAutoProvisionFailed": "Failed to update OIDC auto-provision setting",
+    "updateSecondFactorAfterExternalLoginFailed": "Failed to update second factor setting",
     "updateOidcSilentLoginDefaultFailed": "Failed to update silent OIDC login setting",
     "updatePasswordResetFailed": "Failed to update password reset setting",
     "sessionTimeoutRange2": "Session timeout must be between 1 and 720 hours",