fix: drop unique constraint on mfa_factors.last_challenged_at

[yvlocorp]

last_challenged_at is a per-factor timestamp, but the column was created with a global unique constraint: when factors of two different users are challenged within the same microsecond, the second challenge fails with a 500 (duplicate key value violates unique constraint "mfa_factors_last_challenged_at_key").

Drop the constraint (idempotent) and add a model test showing two factors can record the same last_challenged_at.

Fixes #2854

What kind of change does this PR introduce?

Bug fix

What is the current behavior?

Migration 20240802193726_add_mfa_factors_column_last_challenged_at declares
last_challenged_at timestamptz unique. The column stores the time of a
factor's latest challenge, so the constraint is global across all users: when
two users' factors are challenged within the same microsecond,
Factor.WriteChallengeToDatabase fails on the second UpdateOnly and
POST /factors/{id}/challenge returns a 500
(duplicate key value violates unique constraint "mfa_factors_last_challenged_at_key").

We hit it in our end-to-end test suite, which runs TOTP sign-ins
concurrently: valid requests occasionally fail with a 500, and the only
client-side remedy is to retry the challenge. #2854 measured about 2.5 %
failures with 20 concurrent users.

Nothing in the code relies on uniqueness: last_challenged_at is only read
for the phone MFA send-frequency check (internal/api/mfa.go), per factor.

What is the new behavior?

• New migration dropping the constraint (and the unique index backing it).
  drop constraint if exists keeps it idempotent and safe on projects where
  the constraint was already removed manually.
• Model test showing two factors can record the same last_challenged_at.

No API or behaviour change other than the 500 disappearing.

Additional context

Reproduced the CI job locally (Go 1.27.0, CGO_ENABLED=1, postgres:15
with hack/init_postgres.sql, make migrate_dev, then make test):

• Without the migration, TestFactor/TestFactorsCanShareLastChallengedAt
  fails with duplicate key value violates unique constraint "mfa_factors_last_challenged_at_key" (SQLSTATE 23505).
• With the migration, all 40 packages pass with -race.
• make check-format, go vet, staticcheck and gosec pass.

Note: make vulncheck currently reports GO-2026-6505 in
go.opentelemetry.io/otel v1.44.0 (fixed in v1.45.0). It is unrelated to
this change (no dependency is modified) and should fail the same way on
master; the OpenTelemetry bump to v1.45.0 already seems to be in progress
upstream, so I left it out of this PR.