refactor(auth)!: decouple reauthentication from the FirebaseAuthUI shared state flow

[demolaf]

FirebaseAuthUI was the SDK entry point, the process-wide AuthState channel and the reauthentication session store all at once. Reauthentication requests now travel on their own channel, provider code emits to an AuthFlowScope sink instead of the singleton's flow, and the phase machine lives in a composition-scoped holder — nine members deleted from FirebaseAuthUI, none added.

withReauth no longer retains the caller's lambda on a process-scoped singleton: it raises a request, suspends on a resolver, and retries on the caller's own coroutine. delete() goes through the same path instead of publishing Required and throwing.

• AuthFlowScope.kt: provider extensions move off FirebaseAuthUI, so provider code can no longer reach the public state flow at all — the isolation is compiler-held rather than review-held.
• ReauthFlowState.kt: the phase machine, scoped to one FirebaseAuthScreen's composition. Aborted now clears the phase and resolves the caller under both hosts.
• Added SignInStateSequenceTest and ReauthFlowStateTest, plus emulator-backed e2e coverage for a password change and an account deletion through reauthentication.

⚠️ Breaking Changes

• AuthState.Reauthentication.Required.retryOperation is removed outright — pre-GA, zero external usage, no shim.
• AuthState.Reauthentication.Required's (user, reason) constructor is now internal. Raising a request is withReauth/delete()'s job; constructing one yourself no longer did anything.
• A declined reauthentication throws AuthException.AuthCancelledException instead of returning quietly, and delete() reports that rather than InvalidCredentialsException.
• Publishing AuthState.Reauthentication.Required to authStateFlow() yourself no longer raises a request; only withReauth and delete() do.
• Rotation during the reauth sheet abandons the pending operation unless the caller launched from a scope that survives it.

---

Maintainer note: Fixes internal CPRN-413

[gemini-code-assist]

Code Review

This pull request refactors the reauthentication flow in FirebaseUI Auth to use a composition-scoped AuthFlowScope and coroutine-based suspension (CompletableDeferred) instead of process-local callbacks on FirebaseAuthUI. This prevents sensitive operations from being lost or executed multiple times during Activity recreation. Various auth providers have been updated to emit states through this new scope. Feedback is provided to improve code safety in authUserState by avoiding the !! operator on user.email through smart casting.