sec(auth): TOTP replay window and no lockout on MFA lifecycle failures (follow-up to #94) #442

Split out of #94, which the throttling PR closes.

Two residual MFA hardening items from #94 that the rate-limit fix does not cover:

1. TOTP replay (audit finding A03-016). verifyTOTP (internal/auth/service_mfa.go) accepts counters -1..+1 with no state, and the users row stores no last-accepted counter. An observed code stays valid for up to 90 seconds and can be spent again by Login, MFADisable or recovery-code regeneration. RFC 6238 section 5.2 requires rejecting a previously used code. Fix: persist the last accepted counter and reject anything at or below it.
2. Account lockout on MFA failures. The MFA service methods never call recordFailedLogin, so MaxFailedLoginAttempts / AccountLockoutDuration do not apply to the MFA lifecycle endpoints. The new mfa rate-limit bucket (10 per 15 min per IP and per user) bounds guessing, but it is in-memory per instance on multi-instance deploys (sec(server): "not Lambda" read as "single instance" pins the in-memory rate limiter on multi-replica platforms #109), so a durable lockout would close that gap.