fix: complete current Android CAA login fallback

[subzeroid]

Summary

• retry the current Android CAA login flow when the legacy endpoint returns BadPassword without a legacy two-factor context
• register and persist the signed USDID device identity, obtain server-issued CAA and attestation state, and run the required OAuth preflight asynchronously
• apply embedded login sessions and resolve the supported Verify Profile code challenge through verification_code or challenge_code_handler
• preserve the original login error when the fallback cannot safely start or cannot produce a supported terminal state
• sync the recorded upstream baseline to instagrapi 2.18.14

Thanks @KnifeLemon for documenting the sanitized flow shapes and publishing a reference implementation.

Scope

This is the native async mirror of subzeroid/instagrapi#2766, which fixed subzeroid/instagrapi#2732.

The separate account-recovery UI remains unsupported because its entry component-query contract is not available. This PR handles direct CAA success and the Verify Profile challenge without guessing that missing contract.

Verification

• 765 passed, 13 skipped, 35 subtests passed in the canonical regression suite
• 85 passed in focused CAA/auth/Bloks/upstream regressions
• Ruff check and format, pre-commit, mypy baseline, Bandit, strict MkDocs build, dependency audit, package build, and diff check passed
• the real-network CAA preflight reached USDID registration, server AAC, attestation, OAuth preflight, and credential submission; terminal async authentication was not re-verified because the available server routes did not return a usable terminal session
• the synchronous instagrapi 2.18.14 control produced the same terminal behavior for those routes