test(auth): pin onComplete and factor refresh on successful MFA enrollment

[demolaf]

Nothing asserted that onComplete fires when MFA enrollment succeeds. #2457 removed the recovery-codes step, which moved onComplete one user interaction earlier for every default-configured integrator — the suite would have passed equally well had it been deleted rather than hoisted. The SMS route was unpinned end to end: deleting its enrollWithVerificationCode call left all 633 tests green.

MfaEnrollmentScreen built its handlers inside the composable, so there was nothing to stub. An internal MfaEnrollmentScreenInternal now takes them as parameters and the public composable constructs the real ones and delegates to it; the public signature is unchanged.

Added nine tests across both enrollment routes — TOTP (onComplete fires exactly once with the entered code, the enrolled-factors refresh, the failure path) and SMS (dial-code prefix and session storage, exact enroll arguments, the missing-session guard, send and enroll failures, resend session replacement and its rate-limit gate). Each was verified to fail when the line it pins is removed.

---

Maintainer note: Fixes internal CPRN-383

[gemini-code-assist]

Code Review

This pull request refactors MfaEnrollmentScreen by extracting an internal composable MfaEnrollmentScreenInternal to allow injecting stubbed enrollment handlers for unit testing. It also adds several unit tests to verify successful and failed TOTP enrollment scenarios. The review feedback correctly identifies that the tests incorrectly use the whenever { ... } syntax to stub suspend functions, which will result in a NotAMockException at runtime. These stubbing calls should be wrapped in runBlocking to function properly.

[russellwheatley]

LGTM

The Internal seam keeps the public API clean, and the success tests actually pin onComplete with exact enroll arguments. SMS coverage is more than the issue asked for and I think that's the right call.

A few non-blocking nits if you feel like it: the resend test could assert errors after the final verify, and there's no TOTP twin of the missing-session test. Not worth holding this.