fix(2fa): avoid double QR mint, i18n poll status, send credentials

Co-authored-by: Cursor <cursoragent@cursor.com>

public/assets/js/two_factor.js

@@ -72,13 +72,28 @@
     var pollActive = true;
     var INTERVAL   = 2500; // ms
 
-    function showStatus(msg) {
+    function showStatus(text) {
       if (statusEl) {
         statusEl.style.display = '';
-        statusEl.textContent = msg;
+        statusEl.textContent = text;
       }
     }
 
+    function msg(key, fallback) {
+      var i18n = typeof window !== 'undefined' ? window.CrashI18n : null;
+      if (i18n && typeof i18n.t === 'function') {
+        var s = i18n.t(key);
+        if (s && s !== key) {
+          return s;
+        }
+      }
+      return fallback;
+    }
+
+    function showStatusMsg(key, fallback) {
+      showStatus(msg(key, fallback));
+    }
+
     function stopPolling() {
       pollActive = false;
       if (pollTimer) {
@@ -94,6 +109,7 @@
       var url = pollUrl + '?token=' + encodeURIComponent(pollToken);
       var xhr = new XMLHttpRequest();
       xhr.open('GET', url, true);
+      xhr.withCredentials = true;
       xhr.onload = function () {
         if (!pollActive) {
           return;
@@ -106,7 +122,7 @@
         }
         if (data.status === 'approved' && data.redirect) {
           stopPolling();
-          showStatus('✅ Approved — signing you in…');
+          showStatusMsg('twofa.approved', '✅ Approved — signing you in…');
           setTimeout(function () {
             window.location.href = data.redirect;
           }, 400);
@@ -114,14 +130,14 @@
         }
         if (data.status === 'expired' || data.status === 'used' || data.status === 'not_found') {
           stopPolling();
-          showStatus('⚠️ QR code expired. Reload to get a new one.');
+          showStatusMsg('twofa.qr_expired', '⚠️ QR code expired. Reload to get a new one.');
           if (qrWrap) {
             qrWrap.style.opacity = '0.35';
           }
           return;
         }
         // status === 'pending' — keep polling
-        showStatus('⏳ Waiting for mobile approval…');
+        showStatusMsg('twofa.waiting_approval', '⏳ Waiting for mobile approval…');
         scheduleNext();
       };
       xhr.onerror = function () {