Turn on two-factor everywhere

Two-factor adds a second step to a login, so a stolen password alone isn’t enough. An authenticator app or a passkey is stronger than a text-message code.