Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s
2FA is intentionally optional (not_configured_action=skip on the login flow's validate stage). Users who opt in use the built-in single-stage default-authenticator-totp-setup / -webauthn-setup flows directly, since /if/user/ is blocked for type=external Matrix accounts. Both flows had nothing after the setup stage, so completing enrollment fell back to that same blocked dashboard. Appended the shared redirect stage.