Core-side throttling on finish / step_start

Core imposes no rate limit, throttle, or backoff enforcement on MFA polling. Each finish poll is one SHA-256 plus one indexed point probe, idempotent, with no counter touch on MfaAwaitingExternal. The only binding ceiling is the fixed session window.

Why: poll cadence was handed to the desktop client (#934) as advisory guidance (~1s to ~5s backoff). Nothing about correctness depends on the client complying, which is precisely the argument for a server-side limit. A fast-pumping or buggy client is currently unbounded within the session window.