Admin: active users who have not set up a second factor. Matches unenrolled_count from /admin/overview, so people who sign in through SSO are included even though the login gate never challenges them — their identity provider owns MFA. Never feature-gated, as above.

Takes limit/offset for pagination, and query to search on first name, last name, and email.