fix(fxa-settings): Prevent duplicate passwordless OTP sends on page reload

[vbudhram]

Because

• Refreshing the passwordless code page re-triggered passwordlessSendCode, burning through the per-email rate limit (2 sends / 15 min) and causing "too many requests" errors
• Users navigating back and re-entering the flow could hit rate limits during normal usage patterns

This pull request

• Adds codeSent flag to PasswordlessLocationState and persists it via history.replaceState after the initial OTP send in container.tsx
• Initializes codeSent state from location state so page refreshes skip re-sending
• Relaxes per-email rate limits in rate-limit-rules.txt from 2/15min to 5/15min and 5/24hr to 15/24hr
• Registers signin_passwordless_code and oauth/signin_passwordless_code routes in content-server route configs
• Adds functional test verifying repeated sign-in attempts don't trigger rate limit errors
• Adds unit test for the codeSent location state behavior on page refresh

Issue

Closes: https://mozilla-hub.atlassian.net/browse/FXA-13230
Closes: https://mozilla-hub.atlassian.net/browse/FXA-13229

Checklist

• My commit is GPG signed
• Tests pass locally (if applicable)
• Documentation updated (if applicable)
• RTL rendering verified (if UI changed)

Other Information

How to test:

1. Go to the 123done RP with force_passwordless=true
2. Enter an email to start the passwordless flow
3. On the code entry page, refresh the page (F5)
4. Should remain on the code page without errors — no duplicate OTP sent
5. Navigate back to the RP, re-enter the same email — should reach code page without rate limit error

[StaberindeZA]

r+

[vbudhram]

This fixes https://mozilla-hub.atlassian.net/browse/FXA-13229