examplebroker: Always set the needed auth steps on new session

[3v1n0]

We were setting the needed auth steps only for users that are unknown, but not for the ones we already tracked internally.

This implied that accessing again with the same MFA user did not lead to another MFA session

[Copilot]

Pull request overview

This PR updates the example broker’s NewSession logic to always set neededAuthSteps (and related password-reset flags) for integration-test users based on their username prefix, even when the user is already present in the in-memory exampleUsers map. This fixes repeated logins where MFA users could previously skip MFA because the “needed steps” were only set when the user was first created.

Changes:

• Always apply neededAuthSteps = 3 for MFA-prefixed integration users, regardless of whether they were previously tracked.
• Always apply password-reset requirements (mustReset / canReset) for the relevant integration prefixes, regardless of prior tracking.
• Preserve lazy creation of integration users in exampleUsers (only insert if missing).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.