add MFA, user web mail portal

internal/db/models.go

@@ -10,6 +10,9 @@ type Domain struct {
 	VerificationToken string
 	IsVerified        bool
 	VerifiedAt        *time.Time
+	// MFAExempt overrides [Auth] enforce_mailbox_mfa off for every mailbox under this
+	// domain, regardless of that mailbox's own MFAExempt.
+	MFAExempt bool
 }
 
 type Sender struct {