- two_factor_challenge.php: QR now shown above the code field with
data-poll-token/url attrs; approval status banner; updated caption
- two_factor_approve.php: new mobile confirmation page (Approve/Cancel)
- two_factor.js: adds poll loop every 2.5s; auto-redirect on approval;
expires QR visually; stops polling on manual TOTP submit
Co-authored-by: Cursor <cursoragent@cursor.com>