[#9666] Fixed Settings > Two-factor > Accounts letting an administrator press Require on a single account while the organisation-wide policy was off: the row showed Required and the toast said the account now requires two-factor, but nothing was enforced. Require is now disabled while the policy is off, and its tooltip points to the Policy card above as the switch to turn on first. Exempt and Inherit stay available, so service accounts can be exempted before the policy is switched on. An account that was already set to Required while the policy was off keeps that setting and now shows "not applied - the policy is off" under its badge. Requires the API from release 1.0.0.12495 or later.