Admin: remove another user's two-factor enrollment entirely — the lockout escape hatch for a lost authenticator with no recovery codes. Never feature-gated (a lapsed license must not make lockouts permanent). The affected user is notified by email. They re-enroll from scratch — there is nothing to "reset", the secret lives on their device.

Removing your own enrollment is deliberately refused here: this is a user-management endpoint that takes no second factor (the target can't produce one — that's why an admin is removing it), and the admin UI never collects a code. Self-removal goes through the normal Security page, which re-auths with a fresh factor via /disable. Without this guard a hijacked admin session could strip its own 2FA with only a cookie, turning transient access into a permanent password bypass.