fix(tooling): repair test, i18n and docs verification gates (#3331)

fluxer_docs/src/content/docs/http-api/authentication.mdx

@@ -70,6 +70,7 @@ The public single sign-on state. The same object is embedded by the [instance di
 | enforced<sup>2</sup> | boolean | Whether SSO is required for every user |
 | display_name | ?string | The configured provider display name, or null when none is set |
 | redirect_uri | string | The default OAuth2 redirect URI used for the provider callback |
+| available? | boolean | Whether an SSO provider is configured for this instance |
 
 <sup>1</sup> The value is true only when the operator has enabled SSO and the provider has an authorisation URL, a token URL, a client ID, and a JWKS URL or user info URL. Each URL is configured or discovered from the issuer. A provider that lacks any of them reports false
 
@@ -230,7 +231,7 @@ The result of checking a password reset token without consuming it.
 
 ## Account recovery response object
 
-The result of [recover an account](#recover-an-account). It is an [authentication token response](#authentication-token-response) or an [MFA challenge response](#mfa-challenge-response), with the two fields below added to either shape.
+The result of [recover an account](#recover-an-account). It extends an [authentication token response](#authentication-token-response) or an [MFA challenge response](#mfa-challenge-response) with the two fields below, which are added to either shape.
 
 ### Structure
 
@@ -608,6 +609,8 @@ There is no retry key. A repeated request with the same values creates a second
 | 500 | [error response](/http-api/#error-response) | Unexpected internal failure occurs |
 | 503 | [error response](/http-api/#error-response) | The instance is at its in-flight request ceiling |
 
+The response schema also declares the [MFA challenge response](#mfa-challenge-response), which registration never returns, because a new account has no second factor.
+
 ### Side effects
 
 The operation applies the instance's registration, email-domain, breached-password, and regional policies before creating the account. It records the accepted terms and privacy policy, authorises the registering client IP address, and sends an email verification message when the instance sends email. An instance that sends no email marks the address verified at creation instead.
@@ -1205,6 +1208,8 @@ Fluxer checks the replacement password against the same breached-password corpus
 | 500 | [error response](/http-api/#error-response) | Unexpected internal failure occurs |
 | 503 | [error response](/http-api/#error-response) | The instance is at its in-flight request ceiling |
 
+The response schema also declares the [MFA challenge response](#mfa-challenge-response), which this operation never returns, because the reversion clears every second factor.
+
 ### Side effects
 
 The previous email address becomes verified and the replacement password becomes the account password. All other sessions, second factors and authorised IP addresses are removed. Only the requesting IP address remains authorised.