`POST /users/{id}/mfa-resets` — admin recovery for a native user who lost their second factor (`rh-kk6vbu`). Authz and target rules are `/users/{id}/password-resets`': admin only, 404 outside the caller's org, 400 for a federated or app target.

Targets a single user identified by `(auth.org_id, path id)`, kills their existing Cognito password with a random plaintext the admin never sees, and emails a fresh setup link so the user can pick a new one. Different from `POST /account/forgot-password` in two ways: 1. The admin is the actor; the target user might not know it happened until they read the email. We therefore use a distinct email copy (`SetupFlow::AdminPasswordReset`) that tells the user their old password is dead, not "you can ignore this and keep using your old one." 2. The endpoint is admin-only and not anti-enumeration: the admin can already enumerate their own org's users via `GET /users`, so opaque error responses would add nothing. Returns: - `200 { userId, sentTo, resetAt }` on success. - `400` if the target is a federated or app user (federated → "use your IdP"; service → "no password"). - `403` if the caller is not an admin. - `404` if the target user doesn't exist in the caller's org. - `500` if the org row, Cognito pool, or signing key are missing — these are operator-visible misconfigs, not user errors.