fix: Reset 2FA keeps the privileged-group guard

Resetting the second factors of a privileged-group member now needs
golem15.users.manage_privileged_groups, as changing their password or
deleting them does; without it the action answers 403 before Reset.

controllers/users_admin_controller.go

@@ -798,7 +798,10 @@ func (c usersAdminController) AdminRecordActions() []pact.AdminRecordAction {
 
 // resetTwoFactorAction builds the reset_two_factor record action with the
 // shared action builder, behind classes.PermissionResetTwoFactor and marked
-// as dangerous.
+// as dangerous. A member of a privileged group keeps the takeover guard of
+// a password change and a delete: without
+// golem15.users.manage_privileged_groups Run refuses with a 403 and its
+// message before Reset runs, inside the action's transaction.
 func (c usersAdminController) resetTwoFactorAction(action func(name, label, confirm, success string,
 	applies func(ctx context.Context, user *models.User) (bool, error),
 	run func(ctx context.Context, tx *gorm.DB, user *models.User) error,
@@ -820,6 +823,9 @@ func (c usersAdminController) resetTwoFactorAction(action func(name, label, conf
 			if !ok {
 				return errors.New("users admin: no two-factor plugin publishes classes.TwoFactorAdmin")
 			}
+			if err := c.guardPrivilegedMember(ctx, user.ID, usersLang+"privileged_member_reset_two_factor_forbidden", nil); err != nil {
+				return err
+			}
 			return svc.Reset(ctx, tx, user)
 		})
 	reset.Permissions = []string{classes.PermissionResetTwoFactor}