chore(auth): remove legacy session-token TOTP setup routes

[fxa-agent]

Because

• The auth server has two sets of TOTP setup routes. The legacy set accepts a session token. The /mfa/totp/* set requires an mfa:2fa JWT.
• On main, the /mfa routes forward to the legacy handlers, so the legacy routes cannot go away on their own.

This pull request

• Removes POST /v1/totp/create, /v1/totp/setup/verify and /v1/totp/setup/complete from totp.js, with their Swagger entries.
• Moves the handler bodies onto the /mfa/totp/create, /mfa/totp/setup/verify and /mfa/totp/setup/complete routes.
• Removes createTotpToken, verifyTotpSetupCode and completeTotpSetup from fxa-auth-client. The *WithJwt methods stay.
• Removes the unused createTotpToken wrapper from the content-server fxa-client.js and Account, with its spec.
• Changes the auth-server test client to call the /mfa routes with a JWT from signMfaToken.
• Changes enableTotpOnAccount to use the *WithJwt methods with a JWT from testAccountTracker.getMfaJwtForScope, which is now public. Six functional specs use it.
• Adds an it.each test in totp.spec.ts that checks that the three legacy paths are not registered.

Breaking change: external users of the three endpoints or the three removed client methods must move to /mfa/totp/*.

Issue that this pull request solves

Closes: https://mozilla-hub.atlassian.net/browse/FXA-14626

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on: packages/fxa-auth-server/lib/routes/totp.js
• Suggested review order: totp.js, totp.spec.ts, fxa-auth-client, then the test helpers.
• Risky or complex parts: the deploy order with PyFxA (see below).

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

Any other information that is important to this pull request.

One reviewer call: can this deploy before mozilla/PyFxA#126 ships? PyFxA still calls /totp/create. The ticket says PyFxA#126 moves it to /mfa/totp/*.

Tests I ran on the local stack:

• curl POST to the three legacy paths: 404 each (401 before the change). POST /v1/mfa/totp/create without a JWT: 401.
• passwordlessApi.spec.ts "TOTP account returns unverified session": passed.
• lib/routes/totp.spec.ts: 26 passed. mfa_totp.in.spec.ts and recovery_phone.in.spec.ts: 16 passed. fxa-auth-client mocha: 34 passing.
• Type-check passed for auth-server, auth-client and content-server. ESLint passed on the 17 changed files. functional-tests tsc shows only the originalEmail errors in testAccountTracker.ts that exist on main.

Not run, left to CI:

• signinPasswordless, passkey-signin, cms-2fa and stepUpAuth. They need the 123done relier or the CMS.
• pairingFlow. The sandbox blocks the channel server, and the pairing test without TOTP fails there too.
• The content-server mocha spec.

Kept on purpose: /totp/exists, /session/verify/totp and db.createTotpToken. The MFA routes use db.createTotpToken.

Follow-ups, not in this PR:

• fxa_route_catalog.py is outside this repo and still lists the legacy routes. It needs a separate change.
• packages/fxa-shared/sentry/tag.ts still lists /v1/totp/create as a critical endpoint. That file fails ESLint on main.