Because:
- Step-up auth re-enters no password, so a hijacked session could enrol
an AAL2 factor and trigger the destructive recovery-method clear with
only a session token — no proof of email possession.
This commit:
- Consolidates the TOTP enrolment routes onto /mfa/totp/{create,setup/verify,
setup/complete}, guarded by the `mfa` strategy + `mfa:2fa` scope, and removes
the ungated session-token routes so enrolment always requires an email-OTP JWT.
- Removes the now-dead session-token TOTP methods (create/verify/complete and
the replace pair) from fxa-auth-client; only the *WithJwt variants remain.
- Migrates the auth-server test client to mint an mfa:2fa JWT for TOTP setup,
and updates the functional-test enableTotpOnAccount helper and its call sites
to the email-OTP/JWT flow.
- Adds route-guard unit assertions and an integration test proving a bare
session token is rejected (401/223) before reaching the enrolment handlers.
Closes FXA-14390