fix(platform-objects): require_mfa field help says it needs two-factor on (WIP)

Claude-Session: https://claude.ai/code/session_01Utp6Cai3TgWyncLtR5EwF7
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts

@@ -557,7 +557,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       },
       require_mfa: {
         label: "Exigir autenticación multifactor",
-        help: "Si es true, todos los miembros de esta organización deben registrar una aplicación de autenticación para acceder a los datos."
+        help: "Si es true, todos los miembros de esta organización deben registrar una aplicación de autenticación para acceder a los datos. Requiere que la autenticación de dos factores esté activada en esta implementación (OS_AUTH_TWO_FACTOR=true); mientras esté desactivada, guardarlo como true se rechaza."
       },
       timezone: {
         label: "Zona horaria",

packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts

@@ -557,7 +557,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       },
       require_mfa: {
         label: "多要素認証を必須化",
-        help: "true の場合、この組織のすべてのメンバーはデータにアクセスするために認証アプリの登録が必要になります。"
+        help: "true の場合、この組織のすべてのメンバーはデータにアクセスするために認証アプリの登録が必要になります。このデプロイで二要素認証がオンになっている必要があります（OS_AUTH_TWO_FACTOR=true）。オフの間は true で保存すると拒否されます。"
       },
       timezone: {
         label: "タイムゾーン",

packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts

@@ -557,7 +557,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       require_mfa: {
         label: "强制多因素认证",
-        help: "为 true 时，该组织的每位成员都必须注册身份验证器 App 才能访问数据。"
+        help: "为 true 时，该组织的每位成员都必须注册身份验证器 App 才能访问数据。需要本部署开启双重验证（OS_AUTH_TWO_FACTOR=true）；双重验证关闭时，保存为 true 会被拒绝。"
       },
       timezone: {
         label: "时区",

packages/platform-objects/src/identity/sys-organization.object.ts

@@ -395,13 +395,18 @@ export const SysOrganization = ObjectSchema.create({
     // ADR-0069 D3 — per-org MFA tightening above the global floor. When true,
     // members of this org must enrol TOTP to access data (enforced at the
     // session-validation gate). An org can only tighten, never loosen, the
-    // global `mfa_required` setting.
+    // global `mfa_required` setting. Saving it on is refused while two-factor
+    // enrollment is off for the deployment (plugin-auth's
+    // `organization-mfa-enrollment-guard.ts`), which the help says (#30411).
     require_mfa: Field.boolean({
       label: 'Require Multi-Factor Auth',
       required: false,
       defaultValue: false,
       group: 'Configuration',
-      description: 'When true, every member of this organization must enroll an authenticator app to access data.',
+      description:
+        'When true, every member of this organization must enroll an authenticator app to access data. ' +
+        'Needs two-factor authentication on for this deployment (OS_AUTH_TWO_FACTOR=true); while it is off, ' +
+        'saving this as true is refused.',
     }),
 
     // #14238 — maintainer ruling 2026-09-02, option A (verbatim 「同意」): the