Because:
* step-up requires no password, so inline TOTP enrolment on a live
session had no proof beyond the session token — a hijacked session
could add a second factor and satisfy step-up
This commit (frontend half):
* extracts a host-agnostic MfaGuardCore from the Settings MfaGuard
(context + core + thin wrapper; public API unchanged)
* routes inline TOTP enrolment (InlineTotpSetup, InlineRecoverySetupFlow)
through the email-OTP mfa:2fa JWT path (/mfa/totp/*) via the guard
* adds `service` to completeTotpSetupWithJwt in fxa-auth-client
* covers the guard's block-without-JWT behavior and updates the
container tests
Backend enforcement (require the JWT on /totp/*) is a follow-up.
Closes #FXA-14311