Update disable-user-mfa.mdx with Client Trust warning (#2829)

Co-authored-by: Sarah Soutoul <[email protected]>
Co-authored-by: Michael Novotny <[email protected]>

Author: 3 people

docs/reference/backend/user/disable-user-mfa.mdx

@@ -6,6 +6,9 @@ sdk: js-backend
 
 {/* clerk/javascript file: https://github.com/clerk/javascript/blob/main/packages/backend/src/api/endpoints/UserApi.ts#L206 */}
 
+> [!WARNING]
+> On November 14, 2025, Clerk introduced [**Client Trust**](/docs/guides/secure/client-trust). This free security protection automatically enforces MFA **the first time** a user logs in from a new device even if MFA is disabled. Learn more about [Client Trust and our commitment to security](/changelog/2025-11-14-client-trust-credential-stuffing-killer).
+
 Disable all of a user's MFA methods (e.g. [OTP](!otp) sent via SMS, TOTP on their authenticator app) at once.
 
 ```ts