Login requires OTP twice, when OTP authenticator is unverified

1. Setup Phone OTP as primary login method
2. Mark the phone as unverified in the Portal
3. Try login, and it requires OTP entry twice. Because 1st time is verify, 2nd time is login

Although this case is less likely to happen,
It will be nice if Authgear can combine 2 steps into one.

Reproduce the login flow with Phone OTP as the primary method and the phone marked unverified in the Portal. Trace the verification and login steps to determine how they can be combined; done means an unverified phone requires only one OTP entry while preserving the normal login behavior.

Written by the indexing model from the issue text.