Org deletion staging child and step-up 2FA

Found while building Delete account (Task 10797, PR #7189). - Deleting a parent org (Owner's Delete account or the operator's Delete) leaves its live staging org running on the deleted parent's plan terms. Either refuse with 409 while a live staging org exists ("Delete the staging org first"), or soft-delete the staging org with the parent. - Step-up 2FA on Delete account (`mfa.verify_current_code`) shares the sign-in failure counter, so repeated wrong codes there throttle the Owner's sign-in. Count step-up failures separately from sign-in failures. Out of scope: the delete flow itself, the Plan after cancel setting. Done means: a test shows a parent with a live staging org is refused (or both are deleted); a test shows wrong step-up codes do not throttle sign-in.

Parent org delete refused 409 while a staging org is live (both doors); step-up 2FA failures counted apart (new columns), sign-in doors keep one budget. Quick gate + 169 tests green; review lane pass; PR #7192 queued. Memory: none applied.