Feat/mfa recover self serve

[landonshumway-ia]

We are planning on enforcing MFA for practitioners in the system. In the event that a practitioner loses their MFA device (ie their phone breaks) they will need a way to recover their account and reset their MFA. AWS Cognito does not support this out of the box. We need to implement a custom solution for this which will delete the old Cognito user account and recreate them with a new invite/temporary password. From there they can log in and reset a new password as well as their MFA option.

This recovery process includes the following steps:

User requests MFA reset by submitting username / password and license info
Backend verifies the provided license data matches one of the license records.
That endpoint attempts the first leg of authentication server-to-server against Cognito; validates that the password authentication step was successful
Backend then sends a link to the user's email confirming they want to reset their MFA. The link includes a recovery token, which has a 15 minute expiry.
The link lands the user on a frontend page that attempts to validate the recovery token against the backend. If successful, the backend deletes and then recreates the user's Cognito account, which sends a new invitation email
From there the user can use the invitation email with the temp password to continue and setup their new account

Closes #982

Summary by CodeRabbit

• New Features

  • Provider account recovery: initiate & verify endpoints, emailed recovery link with expiry, reCAPTCHA protection, per-provider rate limits, automatic account-recreation flow, password hashing/verification, and MFA recovery notices in emails.

• Chores

  • Consolidated provider-user Lambdas into a dedicated API Lambda stack; CI now enforces updating the OpenAPI spec when endpoints change; dependency upgrades; enforced password history; small registration processing delay; WAF body-size override; refreshed Postman collection.

• Documentation

  • PR template reminder to update the OpenAPI spec when API endpoints are modified.

• Tests

  • New unit, function, integration, and smoke tests covering recovery flows, emails, tokens, rate limits, and error cases.