feat(auth): make each MFA enrollment step a real navigation destination

[demolaf]

MFA enrollment kept its four steps in local composable state, so onBackClick hand-rolled a back stack by inspecting the selected factor, and backing out of SMS enrollment discarded the phone number the user had typed. Each step is now its own destination, so system back walks them and entered data survives.

Cross-step state moves into a MfaEnrollmentFlowState holder above the NavHost, with hand-written Savers so the SMS session and selected country survive Activity recreation. A TOTP secret can't survive one — the SDK's TotpSecret is an interface with no public reconstruction path — so a lost secret is now regenerated with a fresh QR code and an explanatory message, rather than leaving the user on an opaque "No TOTP secret available" error.

• MfaEnrollmentDestinations.kt: shared graph extension registering the four steps, plus mfaEnrollmentStartStep so a single-allowed-factor config resolves its start step at flow entry instead of auto-advancing past SelectFactor.
• MfaEnrollmentScreen: gained step/onNavigateToStep/onNavigateBack/flowState as a required set (a partial subset throws at composition); a null step preserves today's standalone behaviour.

Added MfaEnrollmentRouteNavigationTest, MfaEnrollmentFlowStateRestorationTest and MfaEnrollmentTotpRegenerationTest — data preservation across step switches and recreation, back-stack ordering, and TOTP regeneration.

Usage

val flowState = rememberMfaEnrollmentFlowState()
NavHost(...) {
    mfaEnrollmentDestinations(navController, configuration, /* … */ flowState = flowState)
}

---

Maintainer note: Fixes internal CPRN-403

[gemini-code-assist]

Code Review

This pull request refactors the MFA enrollment flow to host steps as real navigation destinations, ensuring state survives step transitions and Activity recreation. This is achieved by introducing MfaEnrollmentFlowState and custom savers for CountryData and SmsEnrollmentSession. Feedback on the changes highlights a potential security risk of cross-user state leakage, suggesting that rememberMfaEnrollmentFlowState be keyed on the user's ID. Additionally, it is recommended to wrap a composition-time popBackStack() call in a LaunchedEffect to avoid side-effects during composition.

[gemini-code-assist]

Calling navController.popBackStack() directly during composition is a side-effect and can cause runtime issues or unpredictable navigation behavior. It should be wrapped in a LaunchedEffect to execute safely after composition. Note: You will need to import androidx.compose.runtime.LaunchedEffect at the top of the file.

            } else {
                LaunchedEffect(Unit) {
                    navController.popBackStack()
                }
            }

[demolaf]

Valid, fixing. EmailAuthDestinations.kt:84-89 already has the right shape — LaunchedEffect(Unit) plus a spinner — so this site was inconsistent with its sibling.

Worse than described, too: each pop made the next destination compose with a null user and pop again, so it drained the whole back stack rather than navigating once during composition.