chore: harden totp re-use and account enumeration

[paustint]

No description provided.

[Copilot]

Pull request overview

Hardens authentication flows against account enumeration and one-time-code replay by tightening TOTP acceptance, enforcing single-use OTP consumption, and making credential/password-reset responses more uniform in timing and messaging.

Changes:

• Tighten TOTP verification skew tolerance and add a DB-backed single-use guard for 2FA OTP codes.
• Mitigate login enumeration by equalizing the account-not-found vs wrong-password bcrypt cost and unifying invalid-credentials messaging.
• Reduce password-reset enumeration via timing by not awaiting the email-provider round trip.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 7 comments.

File	Description
libs/auth/server/src/lib/auth.service.ts	Introduces a smaller TOTP grace period constant and uses it during TOTP verification.
libs/auth/server/src/lib/auth.db.service.ts	Adds dummy bcrypt work on account-not-found and unifies InvalidCredentials messaging.
apps/api/src/app/controllers/auth.controller.ts	Adds TOTP replay protection via DbCacheProvider and makes password-reset email sending fire-and-forget.
apps/api/src/app/controllers/tests/auth.controller.spec.ts	Extends api-config mock to include DbCacheProvider for controller tests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.