post:
  operationId: enable2FA
  summary: Enable 2FA with a TOTP secret
  tags: [staffManagement]
  requestBody:
    required: true
    content:
      application/json:
        schema:
          $ref: "../../components.yaml#/components/schemas/EnrollKeyVaultRequest"
        example:
          user_id: "6643f1a2b4c5d60012e34abc"
          secret_id: "secret_xyz"
          code: "123456"
  responses:
    "200":
      description: Enroll result — DTO returned directly
      content:
        application/json:
          schema:
            $ref: "../../components.yaml#/components/schemas/EnrollKeyVaultResponse"
          example:
            valid: true
    "400":
      $ref: "../../components.yaml#/components/responses/Failure"