test(e2e): take the TOTP parameters and the field hooks from the source

The spec re-declared the server's algorithm, digit count and period as
literals, so a change to any of them would leave the spec generating codes the
server no longer verifies and blaming the product. It imports the three
exported constants instead; the recovery-batch size stays a literal, because
its module pulls in the database client and would drag the generated client
into the Playwright process.

The two credential fields on the login form are addressed by test id now, like
the submit button beside them, and the recovery toggle at the challenge is
renamed to the house's noun-verb order.

src/components/auth/mfa-login-step.tsx

@@ -198,7 +198,7 @@ export function MfaLoginStep({
       {hasTotp && (
         <button
           type="button"
-          data-testid="mfa-toggle-recovery"
+          data-testid="mfa-recovery-toggle"
           onClick={() => {
             setUseRecovery((v) => !v);
             setCode("");