Remove legacy MFA from auth

[hellopablo]

Summary

• Stop resetting security questions and authenticator devices from the admin user form. That MFA now lives in module-multi-factor-auth.
• Remove auth's own question and device challenge from login and password reset, including the abandoned sonata-project/google-authenticator dependency.
• Drop the leftover question, device, and token tables. Cherry-pick this onto feature/pre-new-admin with the same migration number so an app moving between the branches runs it once.

The login-method signal stays. module-multi-factor-auth reads it to skip its own challenge after a user-verified passkey login.

Test plan

• Log in with a password and confirm there is no redirect to auth/mfa/question or auth/mfa/device
• Complete forgotten-password and temporary/expired password reset without a security question or device code
• Edit a user in admin and confirm the Security tab only shows the password fields
• Run migrations and confirm user_auth_two_factor_question, user_auth_two_factor_token, user_auth_two_factor_device_secret, and user_auth_two_factor_device_code are dropped
• With module-multi-factor-auth installed, confirm a password login is still challenged and a user-verified passkey login is not