fix: restore async direct CAA login preparation

[subzeroid]

Summary

• Restore the documented direct-call behavior by automatically awaiting the CAA preflight when no server-issued AAC is present.
• Preserve manually prepared and explicit opt-out flows, forward domain and flow overrides through preparation, and roll partial state back on exceptions or cancellation so retries cannot bypass an incomplete preflight.
• Add regression coverage for ordering, failure paths, retries, cancellation, repeated calls, and positional API compatibility, and update the low-level login documentation.

Verification

• Exact CI regression target — 807 passed, 13 skipped, 35 subtests passed
• Focused CAA and adjacent Bloks tests — 50 passed
• ruff check .
• ruff format --check .
• bandit -c pyproject.toml -r aiograpi
• mkdocs build --strict
• pre-commit run --all-files
• uv lock --check
• uv build
• Live credential verification — the direct helper automatically completed the CAA preflight and returned a usable session; domain, waterfall, AAC, and attestation continuity were verified across the flow, with exactly one final credential request. The returned session was not applied or saved.

Fixes #428
Related sync fix: subzeroid/instagrapi#2769