feat(unstitching): unstitch confirm password mutation

[egdbear]

This PR replaces the stitched Gravity confirmPassword mutation with a metaphysics implementation behind the USE_UNSTITCHED_CONFIRM_PASSWORD feature flag, following the same pattern as recordArtworkView.

A new POST /api/v1/me/confirm_password REST endpoint was added in gravity https://github.com/artsy/gravity/pull/19860 to support this.

The schema is kept identical to the existing Gravity mutation (password input, valid boolean output) to avoid breaking any clients. This mutation is actively used in Force for 2FA setup flows (app authenticator, SMS, disable factor, regenerate backup codes). It is not used in Eigen.

[egdbear]

/cc @mzikherman

[mzikherman]

It wouldn't be daylight savings time without one of these every year! Thanks.

[jpotts244]

Heyo, nice!

I might merge in this patch: #7509 to unblock current work, unless this PR is ready to go @egdbear ?

[egdbear]

Thanks @jpotts244, that works!! 🙏

[claude]

Code Review

Summary

This PR unstiches the confirmPassword mutation from the Gravity stitched schema into a native Metaphysics implementation. It follows the established unstitching pattern: feature flag (USE_UNSTITCHED_CONFIRM_PASSWORD), conditional type/mutation exclusion from the Gravity schema, a new native mutation with loader, and corresponding tests.

Issues Found

No blocking or important issues found. The PR follows the established unstitching pattern cleanly and matches existing conventions (e.g., recordArtworkViewMutation).

Areas Reviewed

• Architecture & Design: The unstitching pattern is correctly followed across all required files — config.ts, gravity/schema.ts, schema.ts, the mutation file, and the loader registration. Feature flag gating is properly applied.
• Security: Auth check is present — the mutation throws if confirmPasswordLoader is undefined (unauthenticated). Password is forwarded to Gravity which handles the actual validation, appropriate for a passthrough layer.
• Testing: Good coverage — valid password, invalid password, and unauthenticated user cases are all tested. Tests are correctly gated behind the feature flag with describe.skip.
• Bugs & Edge Cases: The timezone test fix in createPartnerShowEventMutation.test.ts is a sensible change — using a regex to match either GMT-04:00 or GMT-05:00 handles DST transitions that could cause flaky tests.

Looks good to merge. 👍