feat(profile-sync): add MFA step-up sessions

[mathieuartu]

Explanation

Adds MFA step-up verification and a memory-only elevated AAL2 session on AuthenticationController.

• beginStepUp, completeStepUp, getElevatedProfileToken, clearStepUpSession.
• In-memory elevated token with TTL; AuthenticationController:stepUpSession on open/close.
• Session is torn down on lock, sign-out, wallet reset, successful enrollment, and when getElevatedProfileToken observes expiry.
• Completing enrollment or step-up re-asserts the wallet is still unlocked after network calls so a lock during the request cannot reopen an AAL2 session.
• MFA network steps are traced with operation / credentialType tags and span attributes for outcome / mfaCode.

References

Depends on #10266. Stack: stack #10268.
Related to: https://consensyssoftware.atlassian.net/browse/MUL-2263

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

High Risk
Introduces MFA step-up and in-memory elevated token handling in the authentication controller, including session lifecycle and mid-flight session invalidation—security-sensitive behavior for sensitive operations.

Overview
Adds MFA step-up verification and a short-lived elevated (AAL2) session on AuthenticationController, with messenger actions for beginStepUp, completeStepUp, getElevatedProfileToken, and clearStepUpSession.

After completeStepUp, the controller exchanges the MFA assertion for an access token, validates AAL2 JWT claims, and keeps the token in memory only; persisted state exposes only stepUpSessionExpiresAt (plus configurable stepUpSessionTtlMs, default 60s, clamped to token exp). getElevatedProfileToken can enforce caller freshness via maxSessionAgeMs without tearing down the session.

Sessions are cleared on wallet lock, sign-out, reset, successful credential enrollment, TTL/token expiry, and explicit clearStepUpSession. In-flight step-up/enrollment is tied to #authSessionEpoch so a lock mid-request cannot reopen an elevated session.

Related hardening: MFA authentication_required while unlocked invalidates the primary SRP session; MFA tracing records outcome/mfaCode via trace span attributes instead of mutating trace data. README, changelog, and broad unit tests cover the new flow.

^{Reviewed by Cursor Bugbot for commit 07823f4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 98c36cc. Configure here.}