fix(auth): show one terminal MFA expiry state

packages/auth/assets/client/auth.js

@@ -424,11 +424,16 @@
       form?.querySelectorAll("input, button").forEach((control) => {
         control.disabled = true;
       });
-      setMessage(
-        status,
-        "Your sign-in request has expired. Sign in again to get a fresh verification request.",
-        true,
-      );
+      // A form response's finalizer or hydration may re-enable buttons. Hide the
+      // entire stale form instead of leaving a second apparently usable action.
+      element.dataset.mfaExpired = "true";
+      if (form) form.hidden = true;
+      setMessage(status, "");
+      form?.querySelectorAll("[data-error]").forEach((error) => {
+        error.textContent = "";
+      });
+      const expiredMessage = element.querySelector("[data-auth-mfa-expired]");
+      if (expiredMessage) expiredMessage.hidden = false;
       const restart = element.querySelector("[data-auth-mfa-restart]");
       if (restart) restart.hidden = false;
     };