docs: #3621025 Document TFA 2.x architecture, module compatibility, hardening, and pre-production verification

Summary of Changes

This merge request introduces comprehensive pre-production verification checklists, technical architecture references, and third-party module compatibility guides for the TFA 2.x branch.

Based on operational checklists and risk analyses prepared at Pronovix (with review from @cmlara), these additions provide developers, DevOps engineers, and coding agents with the documentation required to safely configure, audit, and deploy TFA 2.x in production environments.

---

What's Included

1. Pre-Production Verification Checklist (docs/pre-production-verification.md)

• Environment & Infrastructure Pre-Flight: Drush commands to verify non-persistent cache configuration (cache.tfa_memcache) and test Key/Encrypt profile decryption.
• Service Decoration Audits: Procedures to inspect the user.auth, account_switcher, and authentication_provider decoration chains.
• Code-Path & Session Integrity: Audit guidelines to detect direct setAccount() invocations, unauthorized session UID injection, magic-link bypasses, and unauthorized manipulation of internal TFA memory flags.
• Documented Exception Register: Operational template to log and track bypassed authentication providers and compensating controls.
• 11-Step Runtime Test Protocol: End-to-end verification covering standard TOTP challenges, flood control, session injection immunity, SSO skip depletion, basic auth passcode concatenation, and API session isolation.

2. TFA Enforcement Architecture (docs/technical/enforcement-architecture.md)

• Comprehensive breakdown of TFA 2.x's 3-layer defense-in-depth model:
  • Layer 1: Authentication Provider Decoration (tfa.auth_provider_bypass)
  • Layer 2: user.auth Service Decoration (TfaUserAuth, priority 100)
  • Layer 3: Fail-Closed Backstop (TfaUserSetSubscriber on AccountEvents::SET_USER, priority 50)
• Mermaid sequence and flowchart diagrams illustrating request lifecycle and validation conditions.

3. Module Compatibility & Integration Pitfalls (docs/technical/module-compatibility.md)

• Architectural guidance and solutions for:
  • Single Sign-On & externalauth: Handling IdP-level MFA vs. dual-layer Drupal TFA vs. role separation.
  • Stateless Gateways & APIs (jsonapi, rest): Session isolation during intermediate challenge states.
  • OAuth2 Bearer Tokens (simple_oauth): Stateless provider bypass and ROPC grant considerations.
  • Alternate Identifiers (mail_login, email_registration): Decorator priorities and username resolution.
  • Login Redirect Modules (login_destination): Preventing destination overwrites during TFA challenge redirection.
  • Administrative Impersonation (masquerade, account_switcher): Service switching vs. interactive session impersonation behaviors.
  • Service Decoration Collisions: Compiler pass ordering and multi-interface provider constraints.

4. Install & Infrastructure Hardening (docs/install-hardening.md)

• Configuration requirements for cache.tfa_memcache when using global Redis or Memcached backends ($settings['cache']['bins']['tfa_memcache'] = 'cache.backend.memory').
• Worker isolation and cache bin reset guidelines for persistent PHP runtimes (FrankenPHP worker mode, Swoole, RoadRunner).

5. Updates to Existing Technical Docs & MkDocs Config

• docs/technical/set-user-protection.md: Updated diagrams, expanded validation condition explanations, and added reference table for internal storage flags.
• docs/technical/login-form-alter.md: Detailed form lifecycle diagrams, validation/submission callback injection mechanics, and module weight considerations.
• docs/configuration/exempt-auth-provider.md: Clarified compiler pass decoration flow and constraints on mandatory non-exemptable providers (cookie, http_basic).
• docs/SUMMARY.md & docs/technical/SUMMARY.md: Updated navigation trees.
• mkdocs.yml: Added admonition and pymdownx.details extensions for enhanced documentation callouts.

Closes #3621025