Poll the status of a 2FA reset

Step 2 — poll while the user completes identity verification, and again after /complete to confirm the new factor was enrolled. status tracks the reset lifecycle (INITIATED → PENDING_REVIEW → LIVENESS_PASSED → COMPLETED, or terminal REJECTED / EXPIRED). For totp / passkey resets, enrollmentStatus gives a finer signal for the enrollment step: PENDING once verification has passed but the new factor has not yet been submitted, COMPLETED once it has. SMS resets have no enrollment step, so enrollmentStatus is null.