fix(jans-casa): fix TOTP replay within same time widnow

1. The replay is exploitable through OTPValidationWS.verify (OTPValidationWS.java:46) — the authentication path. The enrollment path (getExternalUid, called from OTPEnrollingWS / OTPViewModel) also uses validateKey, and replay protection there is unnecessary (one-time step during enrollment) — worth saying explicitly so the developer doesn't guard both and break enrollment retries.
2. The expected remediation, with the existing pattern to copy.Point at the reference implementation: the jans-auth OTP script's validateTotpKey stores the last accepted code in the jansOTPCache user attribute and rejects a repeat (OtpExternalAuthenticator.py:550-562). Note the design decisions the developer must make: store per user or per user+device (a user can have several TOTP devices with different secrets — per-device is more correct, per-user matches the script), and where to persist it (user entry attribute like the script, vs Casa's cache service).
3. Acceptance criteria. Something like: "the same code, submitted twice for the same user/device within one time window, succeeds the first time and is rejected the second; a different valid code in the same window still succeeds; enrollment flow is unaffected."