feat(profile-sync): add MFA validation foundation

[mathieuartu]

Explanation

Adds the MFA validation layer in @metamask/profile-sync-controller that later PRs in this stack consume.

• Superstruct schemas and inferred types for auth-service MFA responses, WebAuthn ceremony payloads, and controller-boundary requests (passkey and email OTP only).
• MfaError family with a stable enumerable mfaCode, plus helpers that survive JSON-RPC serialization (getMfaErrorCode, isMfaError, getMfaRetryAfterMs).
• Shared decodeJwtPayload (no signature verification) and slightly stricter login JWT exp handling.
• Expanded HTTP_STATUS_CODES for later MFA error mapping.

This PR does not call MFA HTTP endpoints or change controller behavior.

References

Stacked under stack #10268. Follow-ups: #10265, #10266, #10267.
Related to: https://consensyssoftware.atlassian.net/browse/MUL-2260

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Touches authentication-adjacent validation, JWT claim handling, and structured MFA errors, though runtime sign-in/MFA flows are unchanged until follow-up PRs.

Overview
Introduces the MFA validation layer in @metamask/profile-sync-controller for later stack PRs—no MFA HTTP calls or controller behavior changes in this diff.

Adds Superstruct schemas and inferred types under authentication-jwt-bearer/mfa for passkey and email OTP flows: auth-service responses, WebAuthn ceremony payloads, enrollment/step-up requests, and AAL2 elevated-token claim parsing (including Hydra ext nesting). assertValidMfaRequest / assertValidMfaResponse map validation failures to MfaError with path details.

Expands MfaError with typed subclasses, stable enumerable mfaCode, and helpers (getMfaErrorCode, isMfaError, getMfaRetryAfterMs) that work after JSON-RPC serialization. Adds shared decodeJwtPayload and refactors login JWT expiry checks to use it with stricter exp typing. HTTP_STATUS_CODES gains 401 and 502 for upcoming error mapping.

Dependencies: @metamask/superstruct (runtime), @metamask/rpc-errors (tests). Changelog updated.

^{Reviewed by Cursor Bugbot for commit d6d147b. Bugbot is set up for automated code reviews on this repo. Configure here.}