[Feature] Require 2FA when inviting/adding a member to an organization #4304

What problem will this feature address?

Currently, there is no way for an organization owner or admin to enforce
two-factor authentication (2FA) when adding members. Once a member accepts
their invitation, they can access the full dashboard without ever setting up 2FA.

For teams managing production infrastructure, this is a security gap —
especially when Dokploy is publicly exposed.

Describe the solution you'd like

Add a "Require two-factor authentication" checkbox to the invite member
dialog (and the add member flow).

When checked:

• The invitation email informs the user that 2FA is mandatory for this org
• On first login, the user is redirected to the 2FA setup screen before
  they can access anything
• The member list shows a visual indicator for users who have/haven't
  completed 2FA setup

Describe alternatives you've considered

1. Org-level global toggle (enforce 2FA for all members)
A setting in org preferences that forces 2FA for everyone rather than
per-invite. Simpler, but less flexible — some orgs may want to exempt
certain service accounts or external collaborators.

2. Post-login warning banner
Show a persistent warning to members who haven't set up 2FA instead of
blocking access. Less disruptive but not truly enforceable — members can
ignore it indefinitely.

3. Handling via Authelia / Cloudflare Access (external tools)
2FA can be enforced at the reverse proxy level using Authelia or Cloudflare
Zero Trust. However, this requires additional infrastructure setup that most
self-hosted users won't configure, and it's outside Dokploy's control entirely.

4. Admin manually removes non-compliant members
Owners can query the database to check two_factor_enabled and remove
members who haven't set up 2FA. This is the current workaround but is
completely manual, error-prone, and not scalable.

5. Restrict permissions until 2FA is set up
Rather than blocking login entirely, limit the member to read-only access
until they complete 2FA setup. A softer enforcement — but read-only access
to production deployment configs is still a risk.

The per-invite checkbox approach is preferred because it gives org owners
granular control without breaking existing flows for orgs that don't need
strict enforcement.

Additional context

The twoFactorEnabled field already exists on the user table and
better-auth handles TOTP enrollment. This feature primarily needs:

1. A require2FA boolean on the member or organization table
2. A middleware/session check that gates dashboard access until 2FA is set up

Will you send a PR to implement it?

Yes