docs(qa): re-point the two-factor-disable mfa_required anchor at a declaration the resolver reads (#21027)

Fixes #20464
Refs #20559
Clause-②: no

## What this does

`pnpm check:platform-checklist` is red on `main` with one ABSENT SYMBOL:
`identity-auth.two-factor-disable-lifecycle` cites
`packages/plugins/plugin-auth/src/auth-plugin.ts#twoFactor`. Since the
`mfa_required` forcing branch became a refusable patch, `twoFactor`
survives in that file only as a key written INLINE in `plugins: {
twoFactor: true }`, which the shared resolver deliberately does not read
as a declaration.

The anchor now names `mfa_required` — the quoted settings key
(`isExplicit('mfa_required')`, `key: 'mfa_required'`) that guards the
same forcing branch — and the parenthetical says why it moved. This is
the same repair shape as the accept-set re-points:
`scripts/symbol-anchors.mjs` is untouched, no citation is dropped to a
bare one.

## Premise check

The behaviour the item tests did not move: `auth-plugin.ts` still forces
`plugins.twoFactor` on whenever `mfa_required` is explicitly on, so the
card's "if the behaviour moved, report instead" branch does not apply.
The item's steps, clauses and oracle are unchanged, so `revision` is not
bumped (a citation re-point is not a semantic edit, as in the accept-set
precedent).

## Verification

- `symbolResolutionClass(auth-plugin.ts, 'mfa_required')` → `literal`;
`'twoFactor'` → `null` (the red), measured at `ef1ed17`.
- `pnpm check:platform-checklist` → `OK — 15 areas, 268 items (264
active, 2 planned)`, symbol anchors `637/647 resolved … 10 on the named
residual` (unchanged residual).

## Changeset

Docs-only (`docs/qa/**`): publishes nothing from any released package —
`skip-changeset`.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01MRdbfpy4sQT8bUjmMhxsN7)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

docs/qa/platform-checklist/areas/identity-auth.json

@@ -1596,7 +1596,7 @@
         "packages/plugins/plugin-auth/src/auth-route-ledger.ts (POST /two-factor/disable, SDK row)",
         "packages/platform-objects/src/identity/sys-user.object.ts#two_factor_enabled (disable_two_factor: password param, visible only while two_factor_enabled) + packages/platform-objects/src/identity/sys-two-factor.object.ts#sys_two_factor (the sys_two_factor variant, same endpoint)",
         "packages/plugins/plugin-auth/src/auth-manager.ts#computeAuthGate (computeAuthGate: MFA_REQUIRED after the grace window; mfa_required_at stamped lazily, no clearing write anywhere in the source; fail-open) + (isAuthGateActive)",
-        "packages/plugins/plugin-auth/src/auth-plugin.ts#twoFactor (mfa_required forces plugins.twoFactor on — 'otherwise gated users would have no way to comply' — the not-stranded contract the last clause tests)",
+        "packages/plugins/plugin-auth/src/auth-plugin.ts#mfa_required (mfa_required forces plugins.twoFactor on — 'otherwise gated users would have no way to comply' — the not-stranded contract the last clause tests; re-pointed: twoFactor is now a key written INLINE in the refusable mfa_required patch literal, which the shared resolver does not read as a declaration, and 'mfa_required' is the quoted settings key that guards that forcing branch)",
         "packages/qa/dogfood/test/two-factor-lockout.dogfood.test.ts (arming + challenge rig + TOTP helper precedent, as on the sibling items)"
       ],
       "history": [