Multi-step MFA session (with legacy single step support)

[kchudy]

Replace the in-memory HashMap login-session store with a DB-backed in-progress MFA sessions identified by an opaque random token. Single-step / legacy behavior is preserved.

Intended changes

• add migration adding vpn_client_mfa_session table
• add VpnClientMfaSession model + helper MFA flow methods:
  • start (supersede + opaque-token mint + insert at step 0, fixed expires_at from the setting)
  • find_active_by_token (NULL past expiry)
  • begin_attempt (mint fresh step_attempt_id, replace prior)
  • mark_oidc_completed (no-op on mismatch)
  • advance (NULL ephemeral_state, current_step += 1, no expiry extension)
  • record_failure (cap at 5)
  • current_step_methods
  • complete_and_delete/delete
  • reap_expired
• rework ClientMfaServer to use the DB instead of the in-memory map (preserve legacy single-step flow)
• hook reap_expired into the existing VPN session loop (or the utility thread?) using the location-level timeout setting
• add integration tests for the new session manager (deleting expired sessions, replacing on restart, recording failures etc)

Verifiable results

• single-step MFA (TOTP/Email/OIDC/biometric/mobile-approve) completes end-to-end via the DB-backed session
• core restart mid-flow does not abort the session
• stale sessions are cleared after a timeout
• tokens are no longer JWT