Two-factor: tell a user at sign-in when someone else changed or bypassed their two-factor #1337

Context

Cluckwork can't send email. In the two-factor design (#1274, PR #1334), the security-sensitive changes to a user's two-factor reach only the audit log:

• an Owner resets the user's two-factor;
• recover-admin clears it;
• someone signs in or steps up with one of the user's recovery codes;
• the recovery codes are regenerated.

So a user whose two-factor was turned off or bypassed by someone else doesn't find out unless an Owner reads the audit log. On 2026-10-21 I decided to ship the milestone with audit rows only and to track a notice here.

What I want

A one-time notice the user sees at their next sign-in after one of those events, for example:

• "Your two-factor was reset by Ana on 21 Oct. Set it up again on the Account page."
• "A recovery code was used to sign in to your account on 21 Oct at 14:02. If that wasn't you, change your password and regenerate your codes."

The notice names who did it and when, and comes from the existing audit row. It shows once and is dismissed by the user. It must never show the code itself.

Open points

• Whether the user's own actions (their own turn-off or regenerate) also produce a notice. My lean is no.
• Whether Owners also see a summary, such as "3 two-factor resets this week", on the Users page.

Depends on

#1280 (reset, turn-off, recover-admin) and #1278 (recovery-code sign-in).