fix(auth): expire stale MFA forms before accepting codes

packages/auth/test/engine.test.ts

@@ -863,6 +863,7 @@ describe("authentication engine", () => {
       requires: { mfa: ["totp"] },
     });
     expect(await engine.beginMfaOtp(firstLogin.mfaToken!, "email-otp")).toBeUndefined();
+    expect(firstLogin.mfaExpiresAt).toBe(now() + 5 * 60_000);
 
     expect((await engine.verifyEmail(verificationToken)).ok).toBe(true);
     const secondLogin = await engine.login({