is there a way to setup 2fa on app.pulumi.com?

If you use an identity provider like GitHub or SAML you can use the 2FA associated with that provider. For email based identity there is not (yet!) 2FA.