Step-up MFA, attenuation, and what's honestly not done

Repo: darkedges/pf12.3-biscuit-datalog-tokens We've covered why a hybrid works, the token generator plugin, and the Terraform plus end-to-end test. Part 3 ended with alice holding orders:write and still getting a 403. This part unlocks that write, narrows the token in a few ways, and then says plainly what doesn't work yet. orders-api's policy has three rules: allow if scope("orders:read"), operation("read"); allow if scope("orders:write"), operation("write"), amr("mfa") trusting authority, ed25519/ ; deny if true; A write needs the scope and an amr("mfa") fact. It also has to be a fact the se