Step-up auth on risk, not fat-finger taps: hysteretic transitions

Stepping up on every threshold crossing produces auth fatigue. The hysteretic state machine BehaviorGuard uses to distinguish session-takeover from brief noise.