fix(core): require a first-party application for account reads that need recent authentication

[wangsijie]

Stack: this is the first PR of a stack. #9774 builds on this branch, and the feature, #9771, sits on top. Merge in that order.

Summary

The Account API reads that need recent authentication — GET /my-account/mfa-verifications/backup-codes, GET /my-account/sessions, GET /my-account/grants, and GET /my-account/trusted-devices — only asserted identityVerified, so any caller holding a valid verification record could read them. Every account mutation has required a first-party application since #9430; these four reads did not, which is the one path left where a third-party application could reach account data.

Each route now asserts a first-party client right after the identity check, the same placement the mutation routes use:

• A caller without proof keeps the existing 401 verification_record.permission_denied.
• A third-party caller that does present a valid record now gets 403 auth.third_party_application_forbidden instead of the data.
• A first-party caller is unaffected.

A third-party application cannot mint the record itself, since the Verification API refuses a third-party caller (also from #9430); the record is owned by the user, so this closes the path where a record minted by another client is presented.

The koaGuard status lists accept the new status — without that, any status outside the list becomes a 500 outside production — and the OpenAPI supplements document the new 403.

Part of LOG-14124.

Testing

Unit tests, integration tests.

• @logto/core: trusted-device.test.ts gains the third-party GET case, which also holds the route's status list to the new status.
• third-party-guard.test.ts gains the case that fails without the fix: a third-party caller presenting a valid verification record gets 403 from all four reads. The record is minted through a first-party client, and left to CI along with the rest of the suite.

Checklist

• .changeset
• unit tests
• integration tests
• necessary TSDoc comments

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.