MFA self management does not respect login policy

2FA and MFA types can be enabled and disabled on the login policy. While the setting is respected in the login UI, it is not in the self management API and UI. User can set up disabled 2FA factors or add new passkeys even if such were not allowed by the login policy.

See also https://discord.com/channels/927474939156643850/1307006457815896094

(Note that the login will only accept allowed factors even when others are set up.)

Acceptance Criteria

• Only allow enabled factors to be set up in API
• Only list enabled factors in Console UI