fix(auth): validate metricsContext on passwordless OTP routes

[vbudhram]

Because

• The three passwordless OTP routes take a metricsContext payload and never check it. METRICS_CONTEXT_SCHEMA only validates the shape, so nothing verifies the HMAC signature on flowId.
• All three routes are auth: false. Any caller can make up a flowId and we record it in flow events and in the OTP email metadata. To be clear about severity: this is a metrics integrity bug, not an auth bypass. No account, session, or token decision reads the value.

This pull request

• Adds request.validateMetricsContext() to sendCode, confirmCode, and resendCode in passwordless.ts. Same one-liner as the existing call sites in session.js, unblock-codes.js, account.ts, and password.ts.
• Adds tests in passwordless.spec.ts for a valid context, a forged signature, and an expired flowBeginTime on each route, plus a check that a forged flowId never reaches the OTP email. These run the real validate() from lib/metrics/context.js, not a stub, so they cover the HMAC check itself.

Issue that this pull request solves

Closes: https://mozilla-hub.atlassian.net/browse/FXA-14340

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

Other information

Worth a second opinion before this lands: validate() does not throw. On failure it deletes flowId and flowBeginTime and returns false. So if passwordless clients are not sending a signed flowId today, this strips the field and the flow metrics for these three routes will change. That call is the reviewer's, not mine.