test(functional): add passkey signin + AMO AAL2 functional coverage

[vbudhram]

Because

• The passkey signin work in FXA-13101 lacked Playwright coverage for the OAuth flows it touches, including the AAL2 divert that prevents AMO's profile-based bounce loop
• 123done's existing "Require 2FA" toggle only exercises the session-level AAL2 check; the AMO-style profile-level AMR check (where availableAuthenticationMethods excludes webauthn) had no test fixture

This pull request

• Adds passkey signin coverage in passkey-signin.spec.ts: email-first sign-in, /signin after submitting an email, error banners, non-AAL2 RPs, AAL2 RPs (with and without TOTP), and the passkeySetPassword.spec.ts passwordless flow
• Adds two AMO-style profile-AAL2 tests (gated to the local target): a passkey-only user is diverted to /inline_totp_setup before the OAuth grant, and a passkey+TOTP user completes straight to the RP
• Extends 123done with a Sign In (Require Profile AAL2) toggle that mirrors AMO: checks profile.twoFactorAuthentication after the grant and bounces back to FxA once if the account lacks TOTP. Surfaces both session-AAL2 (🔒) and account-AAL2 (🛡) on the post-auth page

Issue that this pull request solves

Closes: https://mozilla-hub.atlassian.net/browse/FXA-13103

Checklist

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

Other information

Depends on: FXA-13101 (PR #20635). The AMO profile-AAL2 tests rely on the FxA-side divert in packages/fxa-settings/src/pages/Signin/utils.ts. This PR should land after that one.

How to test locally:

cd packages/functional-tests
yarn test-local --grep "passkey sign-in"
yarn test-local --grep "AMO-style profile AAL2"

The two AMO tests skip on stage/prod (target.name !== 'local') because the /api/profile_aal2 toggle lives only in local 123done.

[Copilot]

Pull request overview

This PR expands Playwright functional coverage for passkey sign-in flows (including Sync OAuth edge-cases) and adds an AMO-like “profile AAL2” enforcement mode to the 123done test relier to validate the FxA-side divert behavior for passkey-only accounts.

Changes:

• Add new functional tests for passkey sign-in across email-first, Sync OAuth fallback/set-password flows, and AAL2 + profile-AAL2 scenarios.
• Extend the passkey polyfill with a “corrupt assertion” mode to exercise invalid-signature server handling.
• Update 123done to support “Require Profile AAL2” (post-grant profile check + one-bounce behavior) and surface account-level AAL2 state in UI + test page object helpers.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/functional-tests/tests/passkeyAuth/passkeySetPassword.spec.ts	Adds Sync OAuth coverage for passwordless+passkey routing through /post_verify/passkey/set_password (with/without TOTP).
packages/functional-tests/tests/passkeyAuth/passkeyPasswordFallback.spec.ts	Reworks Sync passkey fallback test to be UI-driven and adds TOTP-enrolled “no re-prompt” coverage.
packages/functional-tests/tests/passkeyAuth/passkey-signin.spec.ts	Adds broad passkey sign-in functional coverage, including AAL2 and AMO-style profile-AAL2 scenarios.
packages/functional-tests/pages/relier.ts	Adds relier actions and badge checks for the new profile-AAL2 toggle and account/session AAL2 markers.
packages/functional-tests/lib/passkeyPolyfill.ts	Adds a “corrupt” mode that tampers with the assertion signature for negative-path testing.
packages/123done/static/js/123done.js	Displays account-level AAL2 marker and wires up the new “Require Profile AAL2” button.
packages/123done/static/index.html	Adds the “Sign In (Require Profile AAL2)” button.
packages/123done/server.js	Exposes account_aal2 via /api/auth_status for UI/tests.
packages/123done/oauth.js	Adds /api/profile_aal2 flow and profile-based post-grant bounce logic to mirror AMO-style enforcement.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[vpomerleau]

Tests cases look good and thorough on first pass 💎 I'll have a closer look and do some manual testing after the weekly meeting, mainly for the 123done flows