Merge commit from fork

* fix basic auth without mfa

* refactor order to use new basic auth class

* remove session auth taht would bybpass mfa (mfa thing fixed in another session)

* allign with other PRs

prep for merge with https://github.com/inventree/InvenTree/pull/13169/

* fix schema generation

docs/docs/settings/MFA.md

@@ -16,4 +16,6 @@ To make MFA mandatory for all users:
 
 ### Security Consideration
 
+Password based [basic authentication](../api/index.md#basic-auth) against the API is refused for users with MFA configured, and for all users while MFA is enforced. API clients should use tokens (generated in the user interface) or OAuth2 instead.
+
 A user can lock themselves out if they lose access to both the device with their TOTP app and their backup tokens. An admin can delete their tokens from the Database Admin interface (they exist under the 'TOTP devices' / 'static devices' models). This should be a last resort and only done by people knowledgeable about the [Database Admin interface](../settings/db_admin.md), as changes there might circumvent InvenTree's business and security logic.

docs/docs/settings/error_codes.md

@@ -262,6 +262,11 @@ The `middleware` list provided in the configuration file does not include the au
 
 The middleware has been added automatically. To remove this warning, add it to the `middleware` list in your configuration file (after `django_structlog.middlewares.RequestMiddleware`).
 
+#### INVE-W20
+**Password authentication not allowed due to MFA - Backend**
+
+Password authentication is not allowed if the user has MFA enabled or if MFA is enforced globally. Use token or OAuth2 authentication instead.
+
 #### INVE-W21
 **Unsupported class removed from configuration - Backend**