Second login step for accounts with MFA enabled

Auth: User JWT

When the account has MFA enabled, POST /v1|v2/users/login-with-email and POST /v1/users/login (Google / Facebook / Apple / wallet signature) stop after the first factor and answer { mfaRequired: true, mfaToken, expiresIn: 300, methods: ['totp','backup'] } without creating a session. Exchange that token plus a 6-digit authenticator code (or one backup code, XXXXX-XXXXX) here; the response is identical to a normal login (token, refreshToken, fileToken, wsToken, user, ...). App context as for login-with-email (appId in the body or an app JWT).