QA two-factor enrollment

This only enrolls an authenticator. It does not grant admin access; a permanent admin must separately issue a time-bounded grant.