Phase 3b red: login flow tests with SRP mock server

Adds fast-srp-hap (the same SRP library Ente's web client uses, pinned
to 2.0.4) as a runtime dependency.

Tests build a full mock Ente server using fast-srp-hap's SrpServer to
exercise real SRP-6a math end-to-end. The mock handles:
  GET /users/srp/attributes
  POST /users/srp/create-session
  POST /users/srp/verify-session
  POST /users/two-factor/verify
  POST /users/ott
  POST /users/verify-email

7 tests covering:
  * SRP login completing successfully
  * SRP login requiring TOTP (returns { kind: 'totp' })
  * Wrong password (SRP M1 fails server-side checkM1)
  * Email MFA fallback (returns { kind: 'emailOTP' })
  * submitTOTP
  * requestEmailOTP + submitEmailOTP

src/auth/login.ts

@@ -0,0 +1,35 @@
+// Stub: see the README "Development workflow" section for TDD policy.
+
+import type { ApiClient } from "../api/client.js";
+import type { AuthorizationResponse, LoginChallenge } from "./types.js";
+
+export const beginLogin = async (
+    _api: ApiClient,
+    _email: string,
+    _password: string,
+): Promise<LoginChallenge> => {
+    throw new Error("auth.beginLogin not implemented");
+};
+
+export const submitTOTP = async (
+    _api: ApiClient,
+    _sessionID: string,
+    _code: string,
+): Promise<AuthorizationResponse> => {
+    throw new Error("auth.submitTOTP not implemented");
+};
+
+export const requestEmailOTP = async (
+    _api: ApiClient,
+    _email: string,
+): Promise<void> => {
+    throw new Error("auth.requestEmailOTP not implemented");
+};
+
+export const submitEmailOTP = async (
+    _api: ApiClient,
+    _email: string,
+    _code: string,
+): Promise<AuthorizationResponse> => {
+    throw new Error("auth.submitEmailOTP not implemented");
+};