feat: Unify managed auth reauth eligibility and blockers

Stainless-Generated-From: f5bdf95e42b3b049f1382fa0c48381a8002bdc5c

Author: kernel-internal[bot]

src/kernel/types/auth/managed_auth.py

@@ -377,6 +377,7 @@ class ManagedAuth(BaseModel):
             "has_credential",
             "viable_plans_found",
             "no_requirements_recorded",
+            "totp_reauth_allowed",
             "requirements_satisfiable",
             "no_prior_successful_login",
             "no_credential",
@@ -400,8 +401,10 @@ class ManagedAuth(BaseModel):
     - `viable_plans_found` — at least one stored login plan can be replayed
     - `no_requirements_recorded` — no recorded credential requirements to fail
       against
-    - `requirements_satisfiable` — recorded requirements can be met by the attached
-      credential
+    - `totp_reauth_allowed` — TOTP is the only recorded requirement and is safe to
+      attempt automatically
+    - `requirements_satisfiable` — recorded requirements contain no recognized
+      blocker
 
     Negative values (a human must complete the login flow):