fix(security): block two-factor replacement

[juliendargelos]

Summary

• reload the authenticated user from Payload before starting setup or enabling 2FA
• reject setup when an active factor already exists
• reject pending-secret promotion when an active factor already exists

Validation

• pnpm typecheck
• pnpm build

Notes

This is the minimal hotfix for blocking first-factor-only factor replacement. A full step-up rotation flow should be handled separately.