[gen2-migration] Auth codegen can emit the SMS/SNS role ARN as the literal string undefined

## Summary
For apps migrating phone-based sign-in / SMS MFA, the generated auth template can pin an SMS configuration whose IAM role ARN contains the literal token `undefined` (a failed interpolation), e.g. `.../role/sns...`. The resulting configuration is invalid.

## Error
`Can't turn off SMS_MFA when SMS configuration is set for the user pool with a required or optional MFAConfiguration.`

## Details
The role ARN interpolation can fall back to the JS string `undefined`. This appears related to the SMS/SNS-role carryover gap acknowledged as an open follow-up in #14810 / PR #14969.

## Expected
Correctly resolve the SMS role ARN (never emit the literal `undefined`), and emit MFA properties (e.g. `EnabledMfas`) consistently with the adopted pool's real configuration.

## Note
Please confirm current-main reproduction; interpolation bugs are sometimes quietly patched.

## Type
Bug

Reproduce the phone-based sign-in or SMS MFA migration on current main and inspect the generated auth template, especially the SMS/SNS role ARN and MFA properties. Compare the adopted pool's real configuration with the emitted template; done means the ARN contains no literal undefined and MFA properties are consistent.

Written by the indexing model from the issue text.