feat: wire up mandatory 2FA toggle in global settings

Connects the existing UI button to GET/POST /api/admin/totp/required
endpoints. Fetches current state on load, toggles on click.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/admin/pages/Settings.tsx

@@ -122,18 +122,49 @@ export default function Settings() {
     fetchData()
   }, [fetchData])
 
+  const canSecurity = hasPermission('settings.security')
+
   const fetch2FARequired = useCallback(async () => {
-    // TODO: Backend endpoint for 2FA requirement settings not yet implemented
-    setRequire2FALoading(false)
-  }, [])
+    if (!canSecurity) {
+      setRequire2FALoading(false)
+      return
+    }
+    try {
+      const response = await apiFetch(`${API_BASE}/totp/required`)
+      const result = await response.json()
+      if (result.success) {
+        setRequire2FA(result.data.require_2fa)
+      }
+    } catch { /* ignore */ }
+    finally {
+      setRequire2FALoading(false)
+    }
+  }, [canSecurity])
 
   useEffect(() => {
     fetch2FARequired()
   }, [fetch2FARequired])
 
   const handleToggle2FARequired = async () => {
-    // TODO: Backend endpoint for 2FA requirement settings not yet implemented
-    alert.error('Tato funkce zatím není k dispozici')
+    setRequire2FASaving(true)
+    try {
+      const response = await apiFetch(`${API_BASE}/totp/required`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ required: !require2FA }),
+      })
+      const result = await response.json()
+      if (result.success) {
+        setRequire2FA(!require2FA)
+        alert.success(result.message || '2FA nastavení uloženo')
+      } else {
+        alert.error(result.error || 'Nepodařilo se uložit nastavení')
+      }
+    } catch {
+      alert.error('Chyba připojení')
+    } finally {
+      setRequire2FASaving(false)
+    }
   }
 
   const generateSlug = (text: string): string => {