Two-factor setup is not available
/api/auth/mandatory-2fa/setup or /confirm returned 403 because the site is not both allowing and requiring TOTP (AUTH_2FA_SETUP_UNAVAILABLE).
Why this happens
Admin changed mode mid-flow, or the member reached mandatory setup URLs when mode is optional/off. Distinct from Two-factor authentication is disabled on this site (account Settings APIs).
Diagnose and fix
1. Admin: set mode to mandatory if that flow is intended; or optional/off and have members use Account Settings setup.
2. Member: start login again after staff fixes mode.
3. Do not bookmark mid-setup URLs across mode changes.