Document Cloud account security and recovery

[abrichr]

What changed

• adds a first-class account-security guide covering authenticator enrollment, platform-admin step-up, bounded recovery, organization switching, account switching, and sign-out
• adds the guide to the Security navigation and links it from Hosted and desktop-to-Cloud onboarding
• fixes the onboarding claim that an account resolves to exactly one organization; actions are scoped to one active organization and the user can switch workspaces
• adds focused documentation contracts for the server-side admin gates, one-code return path, non-AAL2 recovery, and account/workspace distinction

Why

The live docs contained no MFA or authenticator guidance even though Cloud exposes Security & 2FA and requires a current AAL2 session for platform administration. The onboarding guide also contradicted the shipped organization switcher.

The guide deliberately limits the enforcement claim to platform administration. Ordinary organization-owner/admin actions are not described as AAL2-gated.

Ordering

This PR is intentionally draft. Merge it only after Cloud PR #122 is merged and deployed. The recovery section describes that exact target-state flow: a valid one-time code removes inaccessible factors and returns to replacement-factor enrollment; it never grants AAL2 or opens the protected destination.

After this docs PR is live, web PR #272 can link to it.

Validation

• UV_CACHE_DIR=/tmp/uv-cache-openadapt-ops uv run pytest -q — 72/72 passed
• UV_CACHE_DIR=/tmp/uv-cache-openadapt-ops uv run mkdocs build --strict — passed
• git diff --check — passed