feat(auth)!: migrate auth navigation to Navigation 3

[demolaf]

The auth module now navigates with Jetpack Navigation 3. Destinations are typed NavKeys in a NavBackStack list rather than string routes in a NavHost, so the address a step carries is a field on the key instead of a URI query argument, and the back stack is a plain list the library can inspect without reflection.

Navigation 2 is removed outright — api(libs.compose.navigation) is gone, replaced by api on navigation3-runtime and navigation3-ui.

• AuthRoute.kt: extracted from FirebaseAuthScreen, now a @Serializable sealed interface split into Destination (a real NavKey) and FlowEntry (names a flow, resolves to its start step). Also holds resetBackStackTo, pushUnique and popOrNull.
• AuthUITransitions: three ContentTransform specs receiving Scene<NavKey>, replacing four EnterTransition/ExitTransition lambdas. Scene<NavKey>.authRoute() is public so a consumer can still vary the animation per destination.
• NavDisplay throws on an empty back stack, so every pop goes through popOrNull.

⚠️ Breaking Changes

• AuthRoute is a @Serializable sealed interface; route and routePattern are gone. Email steps carry their address, so AuthRoute.Email.SignUp is now AuthRoute.Email.SignUp(). Email/Phone/MfaEnrollment are FlowEntry, not destinations.
• AuthRoute.Email.Step.withEmail returns a Step, not a String.
• AuthUITransitions takes transitionSpec/popTransitionSpec/predictivePopTransitionSpec instead of the four Navigation 2 lambdas.
• Consumers get navigation3-* transitively instead of navigation-compose.

Usage

AuthUITransitions(
    transitionSpec = { fadeIn() togetherWith fadeOut() },
    popTransitionSpec = { fadeIn() togetherWith fadeOut() },
)

---

Maintainer note: Fixes internal CPRN-403

[gemini-code-assist]

Code Review

This pull request migrates the FirebaseUI Android Auth navigation system from Jetpack Navigation Compose to Navigation 3, introducing a serialized AuthRoute hierarchy to persist the back stack across configuration changes and process death. Feedback on the changes highlights a flaw in the phone number masking heuristic that incorrectly handles three-digit country codes, as well as an opportunity to extract the hardcoded transition duration of 700 ms into a reusable constant.

[russellwheatley]

LGTM - leftover bits can follow up separately