Login as a local user

Returned by /login when the user has no active MFA. Backward-compat with the pre-MFA shape — extra kind field is the only diff.

Returned by /login when the user has at least one active MFA method. The challenge token must be exchanged at /auth/mfa/verify-login.

mfa_methods is computed from the user's actual active method types (plus the implicit recovery_code fallback) so the client only renders branches the user can actually satisfy.

preferred_hint is the most recently used primary factor (totp / webauthn) when both are enrolled — soft UI ordering only; None when neither has been used yet.

extranet_handoff is true when the account holds admin or any sa_* role. NZ guest hosts use this to send operators to the AU-canonical login before starting an MFA ceremony (passkeys are RP-bound to totalparks.com.au). A boolean avoids leaking the full role list on the unauthenticated challenge response.