Document platform-admin MFA in the trust center

[abrichr]

What changed

• adds authenticator-app two-factor authentication and platform-admin step-up to the Trust Center access-control summary
• explains the independent platform-admin allowlist and current-session MFA gates
• describes bounded recovery: a one-time code returns the signed-in account to replacement-factor enrollment but never grants the protected session
• documents the signed-in account menu’s organization switcher, Security & 2FA link, and sign-out action
• links to the new account-security guide and adds a focused public-copy contract test

Why

The live Trust Center described organization RBAC and row-level tenant isolation but omitted the shipped MFA and platform-admin controls. It also did not explain the account-menu behavior customers actually see.

This PR intentionally does not claim that ordinary organization-owner or organization-admin pages are AAL2-gated; that broader action-level enforcement is a separate implementation track.

Ordering

This PR is intentionally draft. Merge it only after:

1. Cloud PR #122 is merged and deployed; and
2. the docs account-security guide is merged and live at /guides/account-security/.

That ordering prevents the public site from promising the corrected one-code return behavior or linking to a route before those surfaces exist.

Validation

• npm test — 135/135 passed
• npm run build — production build passed
• git diff --check — passed

[netlify]

✅ Deploy Preview for cosmic-klepon-3c693c ready!

Name	Link
🔨 Latest commit	f5f2646
🔍 Latest deploy log	https://app.netlify.com/projects/cosmic-klepon-3c693c/deploys/6a63d46635e525000871d4b4
😎 Deploy Preview	https://deploy-preview-272--cosmic-klepon-3c693c.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.