After activation: TOTP enroll wizard (app-based 2FA) + 10 backup codes — MANDATORY default-ON for admin.