feat(auth): wire SMS/email MFA production channels

[marcuspat]

v1.1.0 target

MFA SMS and email channels are stub implementations in v1.0.0. Wire production delivery providers.

Scope:

• SMS: integrate Twilio (or SNS) for TOTP delivery
• Email: integrate SendGrid (or SES) for OTP delivery
• Add provider config via env vars (SMS_PROVIDER, EMAIL_PROVIDER, credentials)
• Remove stub flag from MFA integration tests

Acceptance criteria:

• POST /api/v1/auth/mfa/send delivers real OTP via SMS or email
• MFA adapter tests pass end-to-end against sandbox provider
• Stub implementations behind feature flag for local dev

Context: speakeasy TOTP is fully wired. SMS/email delivery channels are the only remaining MFA stubs.