feat(auth): Add two-factor authentication form (#122333)

Adds the multi-method second-factor surface for TOTP, recovery codes,
SMS, and WebAuthn. The component preserves challenge state across method
switches, cancels stale WebAuthn assertions, and starts a fresh
assertion when the user returns to passkeys.

Back to Login cancels the server-side pending MFA flow before leaving
the form. Authentication, cancellation, method switching, resend, and
WebAuthn controls are mutually disabled while competing requests are
pending, with regression coverage for races and cancellation failures.