Because:
- Dormant accounts signing in to Settings/Sync received two identical OTP
verification emails. The auth-server sends one during `signInWithAuthPW`,
and the shared `handleNavigation` sent a second via `sessionResendVerifyCode`
(added in 2fce100 to fix a cached-flow duplicate, but it also fired in the
password flow where the server already sent).
This commit:
- Gates the client-side `sessionResendVerifyCode` in `handleNavigation` behind
a new optional `sendVerificationEmailFromClient` NavigationOptions flag.
- Sets the flag only in the cached-signin paths (`SigninCached` and the
prompt=none `Authorization` container), the only flows that perform no
server-side login and therefore must send the OTP client-side.
- Leaves the flag falsey for the password/unblock/reauth paths, which already
send server-side, eliminating the duplicate email.
- Adds regression tests covering both the gated (cached) and non-gated
(server-login) paths so the duplicate cannot silently return.
Closes #FXA-14109