feat(signin): support step-up auth in sign-in flow
Because: * an RP requesting step-up (acr_values=AAL2 / max_age) must be challenged for a second factor without prompting for a password, and passkey users were wrongly forced into TOTP enrollment they don't need This commit: * decouples max_age from the password prompt and forwards max_age to the backend so it can enforce authentication freshness * does not force TOTP enrollment for passkey sessions (already AAL2) Closes #FXA-12861