Atomic postures and mfa-flows assignments

[j-chmielewski]

Related issue: #3563

• Posture check and MFA flow assignments are now part of the location payload.
• Removed the standalone assignment endpoints that wrote outside the location form.
• License gating moved into the location save path.
• Location edits are no longer blocked by an expired license.
• Assignment events fire only on real changes.
• Frontend saves assignments with the location form.
• LocationMfaFlowItem now returns group_ids alongside group_names, so the
  client can round-trip assignments without a name lookup.