bug(auth): Fix bad config for otp code expiration

[dschom]

Because

• The email wasn't taking into account that the time in the config was specified in seconds
• The 'step' and 'window' were swapped in the config

This pull request

• Introduces the correct calculation for when the code actually expires
• Specifies the step and window size correctly. Note that the old config still resulted in a code that was valid for 5 minutes, it's just not how the library expects it to be defined.

Issue that this pull request solves

Closes: FXA-12400

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).

Screenshots (Optional)

Other information (Optional)

Any other information that is important to this pull request.

[vpomerleau]

Looks good, just checking it out locally now. Only one docs nit, non-blocking

[vpomerleau]

This is working differently from the window/step defined in otp config in this file, unless that config is unrelated? Maybe specifying that this overrides otplib options would be clearer for anyone checking back on this later.

[vpomerleau]

Tested locally 👍

[dschom]

They are both valid configs. Neither is wrong... I agree normalizing how we define this makes sense though. More importantly we should double check how we calculate the actual expiration time and communicate this to end users.

I have a feeling the expiration time we communicate might not be correct in all cases. i.e. We don't take window and step into account, when doing the calculation, and this could lead to inaccuracies depending on how it is configured. I'll file a separate ticket for this.