feat(fxa-auth-server): migrate MFA/recovery phone Mocha tests to co-located

[vbudhram]

Because

• MFA and recovery route unit tests still use Mocha + chai in test/local/, outside the co-located Jest pattern established for lib/**/*.spec.ts
• Part of the broader Mocha → Jest migration (FXA-12536) to unify the test runner and enable TypeScript-native test files

This pull request

• Migrates 5 Mocha JS test files to co-located Jest TypeScript .spec.ts files:
  • serverJWT.spec.ts — 5 tests, proxyquire → jest.doMock/jest.resetModules
  • recovery-codes.spec.ts — 8 tests, merged assert pattern split
  • totp.spec.ts — 16 tests, TOTP generation via otplib
  • recovery-key.spec.ts — 52 tests, proxyquire → jest.mock with delegating function pattern
  • recovery-phone.spec.ts — 34 tests, largest file (1075 lines), custom Glean mocks
• Converts chai.assert.* → expect().*, assert.isRejected → .rejects.toThrow(), assert.fail guards → .rejects.*
• Preserves sinon.assert.* calls alongside Jest (established codebase pattern)
• Adds Container.reset() in afterAll for TypeDI cleanup
• Does not delete old Mocha files (follow-up task)
• 115 tests, 100% parity with original Mocha suites

Parity Comparison

File	Mocha it()	Jest it()	Mocha Assertions	Jest Assertions	Notes
serverJWT	5	5	16	14	assert.isTrue(spy.calledOnceWith) split; try/catch → .rejects.toThrow
recovery-codes	8	8	27	26	Redundant assert.isDefined removed
totp	16	16	83	72	3 try/catch → .rejects.toMatchObject; assert.fail guards removed
recovery-key	52	52	135	133	assert.fail in .then(fail, err) patterns removed
recovery-phone	34	34	170	150	14 redundant assert.isDefined removed; assert.isRejected → .rejects.toThrow
Total	115	115	431	395	-36 = redundant guards only, no coverage dropped

Issue

Closes: https://mozilla-hub.atlassian.net/browse/FXA-12612

Checklist

• My commit is GPG signed
• Tests pass locally (if applicable)
• Documentation updated (if applicable)
• RTL rendering verified (if UI changed)

Other Information

How to verify:

cd packages/fxa-auth-server
NODE_ENV=dev npx jest --no-coverage lib/serverJWT.spec.ts lib/routes/recovery-codes.spec.ts lib/routes/totp.spec.ts lib/routes/recovery-key.spec.ts lib/routes/recovery-phone.spec.ts

All 115 tests pass. The -36 assertion delta vs Mocha is entirely from removing redundant assert.isDefined guards before property access and collapsing try/catch + assert.fail into Jest-native .rejects patterns — no behavioral coverage was dropped.