Create authenticators from admin api

This is a rare use case but it's possible with the new workflow API.

A login requires Phone OTP and then Email Login link to complete authentication.
Each user set up both passwordless login with phone and passwordless login with email

If the phone identity is deleted, and the "OOB_OTP_SMS " authenticator will also be deleted.
It can not be recovered because the admin API do not support create authenticators.

The createIdentity mutation is based on interaction and it accepts an optional password argument

@louischan-oursky suggested we may want to change the API to resource-based as the combination of identity and authenticator is getting complicated. If we go for the resource-based API approach, we have a breaking change of removing the password argument from createIdentity.

Start with the admin API and the createIdentity mutation described here, then trace how the workflow API handles Phone OTP and Email Login link authenticators. Resolve whether authenticator creation should remain interaction-based or become resource-based, including the proposed password-argument breaking change. Done means the API direction and implementation scope are settled.

Written by the indexing model from the issue text.