Security release: two-factor policies and the two-person rule

A moderation tool is only as safe as the accounts using it, so this release is about locking things down.

• Two-factor sign-in with an authenticator app.
• Per-experience 2FA policy. Owners can require a second factor just to open the dashboard, or only to confirm sensitive actions like bans and data edits.
• Two-person rule. Mark actions that need a second staff member to approve them before they run. It works well for permanent bans and data changes.
• Scheduled actions. Queue a ban or unban to run at a set time.
• Safety limits on what staff can do, so a compromised account can do less damage.

If you own an experience, please turn on 2FA. It takes about two minutes.