fix(auth): show one terminal MFA expiry state

packages/auth/test/mfa-runtime.test.ts

@@ -12,16 +12,18 @@ test("expired and legacy MFA requests are rejected on mount before entering a co
       );
       window.document.body.innerHTML = `<section data-auth-mfa-challenge><form data-auth-mfa-form>
         <input name="mfaToken"><input type="radio" name="method" value="totp"><input name="code"><p data-auth-mfa-status hidden></p><button type="submit">Verify</button>
-        </form><a data-auth-mfa-restart hidden href="/login">Back to sign in</a></section>`;
+        </form><p data-auth-mfa-expired role="alert" hidden>Sign in again</p><a data-auth-mfa-restart hidden href="/login">Back to sign in</a></section>`;
       window.eval(readFileSync(new URL("../assets/client/auth.js", import.meta.url), "utf8"));
       (window as any).WRNexusAuth.mount(window.document);
       expect(window.document.querySelector("button")!.disabled).toBe(true);
       expect(window.document.querySelector<HTMLElement>("[data-auth-mfa-restart]")!.hidden).toBe(
         false,
       );
-      expect(window.document.querySelector("[data-auth-mfa-status]")!.textContent).toContain(
-        "Sign in again",
+      expect(window.document.querySelector<HTMLElement>("[data-auth-mfa-expired]")!.hidden).toBe(
+        false,
       );
+      expect(window.document.querySelector("form")!.hidden).toBe(true);
+      expect(window.document.querySelector("[data-auth-mfa-status]")!.textContent).toBe("");
       expect(window.sessionStorage.getItem("wrnexus.auth.mfa")).toBeNull();
     } finally {
       await window.happyDOM.close();
@@ -121,6 +123,12 @@ test("MFA radios preserve allowed methods and restore continuation without reviv
         detail: { code: "mfa-transaction-expired" },
       }),
     );
+    // Validation finalizers may restore button.disabled after dispatching error.
+    form.querySelector("button")!.disabled = false;
+    expect(form.hidden).toBe(true);
+    expect(
+      window.document.querySelector<HTMLElement>("[data-auth-mfa-challenge]")!.dataset.mfaExpired,
+    ).toBe("true");
     expect(window.sessionStorage.getItem("wrnexus.auth.mfa")).toBeNull();
     expect(window.document.querySelector<HTMLElement>("[data-auth-mfa-restart]")!.hidden).toBe(
       false,