feat: add Okta MFA challenge flow for okta_saml

[YoungJinJung]

Summary

Implements #87 (Okta SAML track #26). Stacked on the #85 exchange PR (base branch: feature/issue-85-okta-saml-exchange); merge the schema and exchange PRs first.

• v1 factor set (explicitly scoped per the issue): TOTP (token:software:totp) and Okta Verify push. TOTP is preferred when both are enrolled because it completes without waiting.
• MFA_REQUIRED now enters a challenge flow instead of erroring: factor selection → verification via the factor's verify link with the state token.
• TOTP: prompts for the code on stderr, verifies once, fails with the returned status on a wrong code.
• Push: sends the notification and polls the verify link (3s interval, 60s deadline) with explicit handling for REJECTED, TIMEOUT, context cancellation, and the poll deadline.
• Accounts with only unsupported factors get an error listing available vs. supported factor types; MFA_ENROLL is reported as "no enrolled MFA factor".
• One-time codes and state tokens are never persisted; the session cache still stores only the exchanged AWS credentials.

Testing

• go test ./... passes: TOTP success and wrong-code failure, push approved-after-polling, push rejected, unsupported-factor listing — all against httptest Okta servers with scripted verify responses.
• make build passes.

Closes #87

Part of #26

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• main

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b45c314d-33d0-41e3-b40f-cf6de7bb2632

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[amazon-q-developer]

This PR successfully implements Okta MFA challenge flow for TOTP and Okta Verify push notifications. The implementation is well-structured with proper error handling, comprehensive test coverage, and security best practices. The code correctly handles MFA challenges without persisting sensitive data, implements appropriate timeouts and context cancellation, and provides clear user feedback. The changes are ready for merge.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

[youngjinjung-linq]

냉정 리뷰 완료. MFA_REQUIRED → TOTP/push 분기, rejection, context cancellation 경로를 확인했으며 이 증분 diff에서 재현 가능한 새 blocker는 찾지 못했습니다.