Require MFA for all technical users by default

• Either as the force MFA option
• Or just in general, no opt-out (how do we handle dev/test?)