Multi-step MFA engine (Start / StepStart / Finish)

Implement the core orchestration engine for the multi-step flow + a thin compatibility layer so old single-step clients run on the exact same engine (no path drift, single PSK/authorize gate).

Intended changes
- add handlers for new RPCs:
- method-less `Start` (validate + posture once, supersede + create session, license-filter, reject at Start if any step has zero licensed or zero user-configured methods, else return the annotated descriptor at current_step=0)
- `StepStart` (validate method ∈ current step with live license re-check + configured check, begin_attempt to mint step_attempt_id, run side-effects, return {step_attempt_id, challenge?}, re-callable to switch)
- `Finish` (verify current step, advance through all steps, return `MfaStepResult`, mint PSK + emit `VpnSessionAuthorized` only on the last step)
- add legacy adapter layer
- add new activity log events: `MfaFlowStarted`, `MfaStepStarted`, `MfaStepCompleted{idx,method}`, `MfaStepFailed{idx,method,reason}`, `MfaFlowCompleted{methods}`
- add tests
- multi-step flow authorizes only after the final step; out-of-order completion impossible
- switching methods within a single step mints a new attempt ID
- stale OIDC callback after a switch cannot complete a later step
- `Start` rejects zero-configured / empty-after-license steps with distinct errors; ordered `mfa_methods` are recorded to DB
- new events are emitted

Verifiable results
- consider adding a mock gRPC client if timing allows since at this point we probably won't have a compatible client
- legacy clients still work with compatible single-step locations
- auth session progress can be watched in the DB