fix: localize short MFA removal code errors (M2-10400)

[sricharan-varanasi]

📝 Description

🔗 Jira Ticket M2-10400

When MFA was enabled and a user attempted to remove it in French, submitting a verification or recovery code shorter than the required format displayed an English error message.

Changes include:

• Validate verification and recovery-code formats before sending the API request.
• Reuse the existing shared MFA validation helpers.
• Pass the MFA code type explicitly so short recovery codes use the correct localized error.
• Add regression tests for short verification and recovery codes.
• Prevent invalid short codes from triggering an API request.

🪤 Peer Testing

• Set the Admin language to French.

• Enable MFA for an account.

• Open Account Settings and select Remove MFA.

• Submit a verification code with fewer than 6 digits.

  Expected outcome: The French verification-code error is displayed: Code de vérification invalide.

• Switch to the recovery-code option.

• Submit a recovery code shorter than the required XXXXX-XXXXX format.

  Expected outcome: The French recovery-code error is displayed: Code de récupération invalide.

✏️ Notes

• Branch is based on the latest develop.
• Focused Remove MFA test suite passes: 38 tests.

✅ Checklist

Functionality

• The feature behaves correctly in practice and fulfills the intended business purpose
• Invalid short verification and recovery codes are rejected before contacting the backend

Testing

• Automated regression tests cover short verification and recovery codes
• Code coverage does not go down as a result of this change
• Focused test suite passes

Security & Data Privacy

• No PII is logged by this change
• This change does not materially affect the security attack surface
• Inputs are validated before being sent to the backend
• No new dependencies were added

Logging/Monitoring

• Logging is implemented for this change
• The change is monitored in production

Performance

• This change does not introduce performance issues

Readability

• Commented-out code is removed
• No debugging code or extraneous logs were added
• Code is consistent with existing MFA validation patterns

Change Safety

• Backend changes are backwards compatible with old clients, or it is well known they are not and a deployment/rollout plan is in place. This includes backend changes being compatible with old mobile app versions, as well as applet versioning within Curious.
• Destructive database migrations are rolled out in stages. For example, renaming a column means adding a new column and migrating the existing data to that column in one deployment. Then monitoring to ensure that field isn’t used, and finally removing the old column in a separate deployment.

[aws-amplify-us-east-1]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-2265.d2ccder08v9rmu.amplifyapp.com

[divbzero]

The latest commit looks good too, thanks @sricharan-varanasi.