feat(auth): add email MFA support

[anivar]

Description

This PR adds support for email-based multi-factor authentication (MFA) using AWS Cognito's EMAIL_OTP feature.

Changes

• Type Definitions: Added MFAEmailSettings type as a boolean flag
• Core Implementation: Enable EMAIL_OTP in UserPool configuration when email MFA is enabled
• Output Mapping: Map EMAIL_OTP to EMAIL in client output
• Tests: Added comprehensive test coverage for email MFA scenarios
• Documentation: Updated README with usage examples

Implementation Details

The implementation uses CloudFormation overrides to enable EMAIL_OTP as direct CDK support is limited. Custom email templates require Lambda triggers and are not included in this minimal implementation.

Usage Example

new AmplifyAuth(stack, 'Auth', {
  loginWith: {
    email: true,
  },
  multifactor: {
    mode: 'OPTIONAL',
    email: true,
  },
});

Testing

• Unit tests added for email MFA enablement
• Tests for combined MFA (SMS + TOTP + Email)
• Output validation tests

Related Issues

Resolves #2159

Checklist

• Changes are covered by unit tests
• Documentation has been updated
• Implementation follows existing patterns
• No breaking changes introduced

[changeset-bot]

🦋 Changeset detected

Latest commit: 46865ce

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@aws-amplify/auth-construct	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR