Fix file workspace and MFA state handling

[bifrost0x]

Summary

• restore truly empty file-manager panes after the final source tab is closed
• present TOTP, passkey, and recovery code as exclusive MFA choices instead of stacked login panels
• remove all enrolled TOTP authenticators when MFA is disabled while preserving passkeys
• clarify the irreversible TOTP removal in the Security UI across all supported locales

Security behavior

• passkeys remain a valid alternative MFA factor and are not removed by disabling TOTP MFA
• MFA disable still requires the existing exact strong step-up grant
• TOTP deletion and the MFA flag update are committed in the same database transaction

Testing

• pytest tests -q — 2076 passed, 33 skipped
• npm run test:js — 307 passed
• npm run test:e2e -- --reporter=line — 92 passed
• npm run lint:js
• npm run vendor:check
• scripts/lock_requirements.ps1 -Check

Closes #143
Closes #144
Closes #145

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: eb221a9db3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".