Post-enrolment MFA configuration

[kchudy]

As a user, I want to configure MFA in the desktop client when connecting to an MFA-protected location, so that I can access protected resources without re-enrolling the whole instance.

Acceptance Criteria

• When a user without configured MFA attempts to connect to an MFA-protected location, the client detects the missing MFA configuration.
• The client prompts the user to configure MFA directly in the application.
• After successful MFA configuration, the user can connect without re-enrolling the instance.
• Existing enrolled instances do not need to be removed and added again.
• The flow supports users with the Enrolled status.