fix(auth): expire stale MFA forms before accepting codes

packages/auth/components/TwoFactorChallenge.wrn

@@ -51,8 +51,15 @@ component TwoFactorChallenge {
         <p data-error="_form" role="alert" class="m-0 hidden rounded-[var(--wrn-radius-sm)] bg-[color-mix(in_srgb,var(--wrn-color-danger)_10%,transparent)] p-3 text-sm text-[var(--wrn-color-danger)]"></p>
         <Button type="submit" label="{submitLabel}" variant="solid" color="{color}" size="{size}" fullWidth="true" />
       </form>
-      <a href='{signInHref}' data-auth-mfa-restart hidden class="mt-4 text-sm text-[var(--wrn-color-primary)] underline">Sign-in verification expired. Back to sign in</a>
-      <a href='{recoveryHref}' class="mt-4 inline-flex text-sm text-[var(--wrn-color-primary)] hover:underline">Account recovery options</a>
+      <nav class="wrn-auth-mfa-links" aria-label="Sign-in help">
+        <a href='{signInHref}' data-auth-mfa-restart hidden>Back to sign in</a>
+        <a href='{recoveryHref}'>Account recovery options</a>
+      </nav>
     </section>
   }
+  style {
+    .wrn-auth-mfa-links { display: flex; flex-direction: column; align-items: flex-start; gap: 0.75rem; margin-top: 1.25rem; }
+    .wrn-auth-mfa-links a { color: var(--wrn-color-primary); font-size: 0.875rem; }
+    .wrn-auth-mfa-links a:hover { text-decoration: underline; }
+  }
 }