fix(portal): configurable MFA timeout + skip IMAP poll on device-recognized login

[shmuelsash]

Problem

Two MFA rough edges hit on EdFinancial (and any servicer with similar behavior):

1. Hard-coded MFA timeout. poll_gmail_imap_for_code defaults to 120s. When the code email is slow, the run times out even though the code eventually arrives.
2. Hang when no email is sent. EdFinancial sometimes recognises a trusted device/credentials and advances straight past the MFA step without sending an email code. The IMAP poller then waits the full timeout for an email that never comes.

Fix

• Add GmailImapConfig.mfa_timeout_seconds (env GMAIL_IMAP_TIMEOUT_SECONDS, default 300) and thread it through the poll_gmail_imap_for_code MFA provider in all three call sites, so slow delivery no longer hits the 120s ceiling.
• After clicking Send, give the portal a moment to settle and check _looks_logged_in / _looks_like_mfa. If it has already advanced past MFA, log it and skip the IMAP poll instead of blocking until timeout.

Notes

• No new dependencies. poll_gmail_imap_for_code already accepts timeout_seconds; this just makes it configurable and wires the default through.
• Servicers that still require an emailed code (e.g. Nelnet) are unaffected — the skip only triggers when the portal is no longer on the MFA page.

[mattebad]

Thanks for the work on this. Approved