Return auth.method_unavailable when a user requests an auth method that is not enabled for their account, rather than silently sending the smtp-link challenge. Also log requested/selected method details in auth.request_access audit entries for easier diagnostics.