post:
  operationId: reEnroll2FA
  summary: Re-enroll 2FA for a staff user
  description: |
    Admin or Owner resets a staff member's Two-Factor Authentication
    (Google Authenticator).

    The operation:
    1. Revokes the existing TOTP secret in Google Key Vault.
    2. Clears `two_fa_secret` and sets `two_fa_status` to `NOT_CONFIGURED`
       in the staff's document.
    3. Revokes all active sessions of the target staff (best-effort).

    After calling this endpoint, the target staff user must re-enroll 2FA
    by calling `generateQRCodeLogin` → `enable2FA` on their next login.
  tags: [staffManagement]
  requestBody:
    required: true
    content:
      application/json:
        schema:
          $ref: "../../components.yaml#/components/schemas/ReEnroll2FARequest"
        example:
          user_id: "6650f0a2e1b2c3d4e5f60718"
  responses:
    "200":
      description: 2FA re-enrollment triggered successfully.
      content:
        application/json:
          schema:
            $ref: "../../components.yaml#/components/schemas/ReEnroll2FAResponse"
          example:
            success: true
            message: "2FA re-enrollment triggered"
    "400":
      $ref: "../../components.yaml#/components/responses/Failure"