Remove routes that have mfa variants, update routes to use verifiedSessionToken as needed

[vbudhram]

Because

• Endpoints with /mfa variants were deprecated but still existed in the codebase, causing confusion and maintenance burden
• Session and account verification checks were duplicated in both auth strategies and route handlers
• Auth strategies now handle session verification, making handler-level checks redundant

This pull request

Removes deprecated endpoints (replaced with /mfa variants):

• POST /recovery_email
• POST /recovery_email/destroy
• POST /recovery_email/set_primary
• POST /recovery_email/secondary/verify_code
• POST /recovery_email/secondary/resend_code
• POST /totp/destroy
• POST /totp/replace/start
• POST /totp/replace/confirm
• POST /recovery_phone/change
• POST /password/forgot/send_code
• POST /password/forgot/resend_code
• GET /password/forgot/status

Updates auth strategies to verifiedSessionToken:

• POST /totp/setup/verify
• POST /totp/setup/complete
• POST /recoveryKey/verify
• POST /password/create

Removes redundant session verification checks:

• Removes unverifiedAccount() and unverifiedSession() checks from handlers in totp.js, emails.js, recovery-key.js, and password.ts (now handled by auth strategies)

Deletes corresponding tests for all removed endpoints and outdated verification checks

Issue that this pull request solves

Closes: https://mozilla-hub.atlassian.net/browse/FXA-12420

Checklist

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).

Other information (Optional)

This is a breaking change for any clients still using the deprecated endpoints. All affected endpoints have /mfa variants that should be used instead. The inline setup flows (setup recovery key, setup TOTP) continue to use their non-/mfa endpoints as those are still needed.