CLI MFA step-up completion — exchange mfa_token + TOTP for tokens

Completes the aal2 step-up begun by POST /auth/login (which answers 200 { mfa_required, factor_id, mfa_token } for a ready-TOTP user). The client submits the opaque mfa_token from that response together with the current TOTP code; on success the bearer token pair is returned in the JSON body, exactly like the factorless /auth/login 200. Cookie-free (a CLI has no cookie jar, unlike /auth/mfa/verify). The mfa_token is single-use and TTL-bounded. If the user's email domain has since come under SSO enforcement, the tokens are withheld: 403 sso_required (or 503 sso_check_unavailable when that check cannot be completed). Rate-limited.