Require hard key auth with Cloudflare Access

What this post added

This post details the implementation of a new Cloudflare Access rule that enforces the use of hardware security keys (WebAuthn/FIDO2) for accessing internal administrative panels. This is achieved by leveraging the `amr` (Authentication Method Reference) field within the JSON Web Token (JWT) generated by the identity provider. By configuring Cloudflare Access to require specific `amr` values, the system can reject logins that use less secure MFA fallbacks like TOTP, even if the identity provider allows them. This directly addresses the risk of phishing attacks targeting administrative panels.