enroll wf: re-add 'allow manual auth'

The 'allow manual authentication?' workflow condition was erroneously removed in the previous commit. This commit re-adds the condition and corresponding workflow state.