Adds MFA support to the auth0-server-python SDK via a new MfaClient (server_client.mfa) that handles the full MFA lifecycle — enrollment, challenge, and verification — for all supported factor types: OTP, SMS, Voice, Email, Push Notification (Auth0 Guardian), and Recovery Code.

What's Included

• MfaClient with 4 methods: list_authenticators, enroll_authenticator, challenge_authenticator, verify
• Session persistence — verify(persist=True) auto-updates the session store with new tokens
• MFA token encryption — secure handling of mfa_token between requests
• Push notification support — enrollment via Guardian QR code, challenge/verify via polling
• Recovery code handling — verify() returns recovery_code on first enrollment and after recovery code use
• New types: AuthenticatorResponse, ChallengeResponse, OtpEnrollmentResponse, OobEnrollmentResponse, MfaVerifyResponse
• New errors: MfaRequiredError, MfaChallengeError, MfaEnrollmentError, MfaVerifyError, MfaTokenExpiredError
• Unit tests covering all MFA operations across all factor types
• Comprehensive docs in examples/MFA.md

Quick Example

from auth0_server_python.error import MfaRequiredError

try:
    access_token = await server_client.get_access_token()
except MfaRequiredError as error:
    mfa_token = error.mfa_token

    authenticators = await server_client.mfa.list_authenticators({"mfa_token": mfa_token})

    if not authenticators:
        enrollment = await server_client.mfa.enroll_authenticator({
            "mfa_token": mfa_token, "factor_type": "otp"
        })
    else:
        auth = authenticators[0]
        factor_type = auth.oob_channel if auth.authenticator_type == "oob" else auth.authenticator_type
        challenge = await server_client.mfa.challenge_authenticator({
            "mfa_token": mfa_token, "factor_type": factor_type, "authenticator_id": auth.id
        })

    verify_response = await server_client.mfa.verify({
        "mfa_token": mfa_token, "otp": user_code, "persist": True,
        "audience": "https://api.example.com"
    })

    if verify_response.recovery_code:
        print(f"Save this recovery code: {verify_response.recovery_code}")