OAuth 2.1 server: no way to require MFA (aal2) for OAuth client access tokens

[jhurleyai]

Problem. Tokens issued by the OAuth 2.1 server always carry aal: "aal1" and amr: [{"method":"oauth_provider/authorization_code"}]. The OAuth session is created fresh at AAL1 (/oauth/token → IssueRefreshToken → models.NewSession), and the consenting session's AAL is never considered. The consent endpoints (GET /oauth/authorizations/{id}, POST …/consent) only require authentication, not a particular AAL, and the GET auto-approves a previously consented client. So a resource server that requires aal2 (e.g. an MCP server fronting sensitive data in a project that enforces TOTP for its users) cannot accept any OAuth token, and has no supported way to know that consent was given from an MFA-verified session.

Request (any of):

1. Stamp the OAuth session with the consenting session's AAL/AMR (e.g. aal2, amr including totp), as suggested as an alternative fix in chore: Update to use the latest version of supabase_flutter #2801.
2. An OAuth server setting to require aal2 on the consenting session for the authorize/consent endpoints, including the auto-approve path.
3. At minimum, pass the authorization/consent context (authorization id, or the consenting session's AAL) into the Custom Access Token Hook input, so projects can implement this themselves without relying on internal tables.

Related: #2801 (MFA verification deletes OAuth client sessions). Together these make MFA-enforced projects unable to use the OAuth 2.1 server for MCP clients.