MFA deps (qrcode, image, totp-rs, base32, hmac, urlencoding) now behind optional 'mfa' feature, enabled by default. sha1 and secrecy remain non-optional (used by mtls/revocation.rs and jwt/service.rs respectively). Builds with --no-default-features --features minimal skip ~50 transitive deps (rav1e, ravif, image codecs, etc.). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>