Triage MFA-fatigue (push bombing) detections from Entra ID sign-in
logs, where a burst of MFA denials (sign-in error code 500121 —
`status.errorCode` natively, `status_code` when normalized to OCSF)
is followed by a successful login. Separates real coercion from
habitual deniers by checking VIP membership, denial velocity, and the
user's historical denial baseline.
