Google Authenticator already set up — turn on or off from Settings
POST /api/account/2fa/setup refused because Google Authenticator is already configured for this member. Use Turn on or Turn off from Settings instead of starting a new QR.
Why this happens
A secret exists (resolveTwoFactorConfigured) but the member clicked setup again. Setup only runs once; afterward enable/disable toggles the flag.
Diagnose and fix
1. In Account Settings: Turn on if off, or Turn off (if allowed) then set up again.
2. If stuck, staff Reset user 2FA / sessions.
3. Mandatory-login path uses the “sign in with code” sibling instead.
4. If site 2FA is off, you see Disabled by administrator / unavailable — not this message.