feat(auth): require verified new-browser trust with fixed expiry

packages/auth/components/TwoFactorChallenge.wrn

@@ -1,4 +1,4 @@
-import { Button, Input, PinInput, Radio } from "@wrnexus/ui"
+import { Button, Input, PinInput, Radio, Checkbox } from "@wrnexus/ui"
 
 component TwoFactorChallenge {
   props {
@@ -45,6 +45,7 @@ component TwoFactorChallenge {
         <div data-auth-mfa-pin><PinInput label="Verification code" name="otpCode" length="6" inputMode="numeric" autocomplete="one-time-code" color="{color}" size="{size}" /></div>
         <div data-auth-mfa-recovery hidden><Input label="Recovery code" name="recoveryCode" autocomplete="off" maxlength="32" color="{color}" size="{size}" /></div>
         <p data-error="code" class="m-0 text-sm text-[var(--wrn-color-danger)]" aria-live="polite"></p>
+        <Checkbox name="rememberDevice" label="Trust this device for 30 days" value="true" />
         <p data-auth-mfa-status role="status" hidden class="m-0 rounded-[var(--wrn-radius-sm)] bg-[color-mix(in_srgb,var(--wrn-color-primary)_10%,transparent)] p-3 text-sm text-[var(--wrn-color-primary)]"></p>
         <p data-error="mfaToken" class="m-0 min-h-4 text-xs text-[var(--wrn-color-danger)]"></p>
         <p data-error="challengeId" class="m-0 min-h-4 text-xs text-[var(--wrn-color-danger)]"></p>