So I don’t know what stepTwo.file is, but I presumed it’s a File object instance, and I believe the issue here is that you’re not aware that you didn’t actually need to manually set the Content-Type header because when the request body is a FormData instance, then the content type header will always default to multipart/form-data.
Therefore just get rid of that header from the headers list in your fetch() call and then in your endpoint callback, use WP_REST_Request::get_file_params() to get the uploaded file data (name, temporary path, size, etc.). So for example, you could do $request->get_file_params()['stepTwo']. ($_FILES['stepTwo'] would also work, but I’d use the class method)
As for the stepOne parameter (which would be stored in the $_POST array), you could simply do $request['stepOne'] to get the value, or you could also do $request->get_param( 'stepOne' ).
See https://developer.wordpress.org/rest-api/extending-the-rest-api/adding-custom-endpoints/#arguments for more details.
Additionally, you should always set permission_callback, so for example if your REST API endpoint is public, you could do 'permission_callback' => '__return_true'.