Auth: Auto-enforce AAL2 at API gateway level for MFA-enrolled users

Hi all! First time poster. Developing my first app that uses Supabase. About 6.5 months in :) When a user has enrolled a TOTP factor, Supabase currently still accepts aal1 JWTs for API queries. That essentially makes MFA very easy to bypass by any bad actor that has a user's password, unless you take certain cumbersome precautions. Enforcement of aal2 is only possible by manually adding (auth.jwt() ->> 'aal') = 'aal2' to every RLS policy — which is error-prone, easy to miss on new tables, and requires developers to remember to do this consistently (you could also add it as conditional so it only requires aal2 if the user has opted into TOTP). Requested behavior: An option (per-project or per-user) that causes PostgREST/the API gateway to automatically reject any request bearing an aal1 token if the authenticated user has one or more verified MFA factors enrolled. This would mirror how Azure AD Conditional Access works: MFA enrollment trigger…