add MFA, user web mail portal

internal/config/config.go

@@ -82,6 +82,11 @@ var defaults = []struct {
 		{"rp_display_name", "mailgoserver", ""},
 		{"", "", `Full origin (scheme+host+port) the dashboard is served at, e.g. "https://mail.example.com"`},
 		{"rp_origin", "http://localhost:5000", ""},
+		{"", "", "Require every admin account (global or domain-scoped) to set up TOTP/passkey MFA"},
+		{"enforce_admin_mfa", "false", ""},
+		{"", "", "Require every mailbox's self-service webmail login to have TOTP/passkey MFA"},
+		{"", "", "(overridable per-domain or per-mailbox — see the Domains/Mailboxes edit pages)"},
+		{"enforce_mailbox_mfa", "false", ""},
 	}},
 	{"IMAP", []defaultKV{
 		{"", "", "IMAP server configuration for mailbox retrieval (Thunderbird, etc.)"},