Create a token from an MFA challenge

This endpoint serves to complete the MFA (multi-factor authentication)
challenge and return an access and refresh token pair. The complete login
sequence for an MFA-enabled user is as follows:

1. The client sends a POST request to /token with the username and
   password in the request body.
2. The API returns a challenge in the response body.
3. The client sends a POST request to /token/challenge with the
   challenge and code in the request body.
4. The API returns an access_token and refresh_token in the response
   body.

Access and Refresh tokens should be treated as sensitive data and should
be stored securely.