Teach the doctor to remove orphaned two_factor with forgejo doctor check --run check-db-consistency --fix. Such rows may contain invalid data and block the migration to v10 with a message such as failed: AesDecrypt invalid decrypted base64 string: illegal base64 data at input byte 0.