Set the tenant's sign-in policy (enforce 2FA)

Sets the tenant-wide "Enforce 2FA for all members" flag of the scope's tenant and pushes it to the sign-in service, so it binds every member of the tenant on their NEXT sign-in. Writes only the resolved tenant's setting (never a client-supplied tenant). No session is revoked: turning enforcement on does not sign anybody out (use the user revoke action for that). Turning it OFF never relaxes a member another tenant still enforces 2FA for, nor a platform operator — those members keep the requirement. Validation: body is exactly { enforceMfa: boolean } — a missing/non-boolean value or an unknown property → 422 VALIDATION_FAILED. RBAC: MANAGE on iam plus the iam:write token scope, AND the caller must be an OWNER OF THE TENANT (a built-in owner grant of tenant kind): a project or subscription owner, or a custom role carrying iam: manage, is refused 403 (details.reason TENANT_OWNER_REQUIRED). A tenant on non-payment hold is read-only → 403. Async & state: Synchronous — returns 200 with the persisted value. The push to the sign-in service runs BEFORE the local commit, so a push failure rolls the setting back and answers 500; the setting and its enforcement never disagree. Errors: 401 unauthenticated; 403 not a tenant owner, missing iam MANAGE / token scope, or tenant on hold; 404 unknown scopeId; 422 invalid body; 500 sign-in service or internal failure (nothing was applied). Idempotency/Concurrency: Idempotent by value — repeating the same body re-applies the same setting. No Idempotency-Key is required.