MFA last-validation skip across stages and trusted IPs

## What

MFA last-validation / skip: MFA cookie/threshold only works for one stage, and IP-based MFA skip broke in 2025.12.

## Want

- MFA last-validation / skip: MFA cookie/threshold only works for one stage,
- IP-based MFA skip broke in 2025.12

## Ideas this came from

- [#20142 MFA cookie only works for one stage.](https://github.com/goauthentik/authentik/issues/20142) — Is your feature request related to a problem? I have a use-case where I want the MFA to be required and requested more frequently for apps where sensitive data
- [#20259 MFA skipping not working anymore since 2025.12](https://github.com/goauthentik/authentik/issues/20259) — Hello, I've got a flow to skip MFA when the IP is private or the ip is one of my two static IP's. It worked flawlessly until I updated to 2025.12. How to reprod

Start by reading linked issues #20142 and #20259 and reproducing MFA behavior across multiple stages and trusted or private IPs. Done means the last-validation threshold works across stages and IP-based MFA skipping works again, with regression coverage identified for both cases.

Written by the indexing model from the issue text.