fix(cluster0): 2FA nginx routes and extend pending-2FA on poll

Co-authored-by: Cursor <cursoragent@cursor.com>

sim/cluster0/lab-seeds/backend/public/index.php

@@ -274,6 +274,8 @@ if (
         echo json_encode(['status' => 'expired']);
         exit;
     }
+    // Keep the pending-2FA window alive while the desktop polls (5 min from last poll).
+    $_SESSION['pending_2fa_exp'] = time() + 300;
     $status = AuthApproval::pollStatus($rawToken);
     if ($status === 'approved') {
         // Attempt to complete the login server-side within this same request