feat(amd-agent): probe script documenting no self-service TOTP in AMD

Captures the dead-end finding: AdvancedMD's identity SPA has no
authenticator/TOTP enrollment route (all security routes redirect to
root); email-confirm is the only end-user MFA. Reusable CDP probe to
re-verify on the AGENT session (port 9223). No secrets.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>