feat(settings): require OTP for inline TOTP enroll

[StaberindeZA]

Because

• step-up requires no password, so inline TOTP enrolment on a live session had no proof beyond the session token — a hijacked session could add a second factor and satisfy step-up

This pull request

• extracts a host-agnostic MfaGuardCore from the Settings MfaGuard (context + core + thin wrapper; public API unchanged)
• routes inline TOTP enrolment (InlineTotpSetup, InlineRecoverySetupFlow) through the email-OTP mfa:2fa JWT path (/mfa/totp/*) via the guard
• adds service to completeTotpSetupWithJwt in fxa-auth-client
• covers the guard's block-without-JWT behavior and updates the container tests

Issue that this pull request solves

Closes: #FXA-14311

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on:
• Suggested review order:
• Risky or complex parts:

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

Any other information that is important to this pull request.