This seems to be coming from the server. I can’t find that string in the database (say in customized text) or grepping all of /var/www/discourse
There is no Payload tab:
Wait!!! I restored the database to another server and it properly redirects to the second factor page, which, after getting the second factor key, immediately changes the user’s admin status (no email required! which I didn’t know!).
So it’s something with . . . something, but a clean mostly-standard install resolves the problem. In any case, not (obviously?) a 
. I changed the category.
The other potential explanation, which also seems far-fetched, is that there is something somehow wrong with the UserSecondFactor model, as I did a UserSecondFactor.all.destroy_all;UserSecurityKey.all.destroy_all; on my test server since it had a different domain name. I also used Google authenticator instead of my Yubi key.