Fix TOTP form double-submission and add error branch coverage

[Copilot]

The TOTP login form was missing e.preventDefault() in its submit handler, causing a native GET submission to race with the Inertia POST. The handleKeyDown Enter path also called verifyTotp() directly, which broke when the function signature required a FormEvent.

Changes

• inertia/pages/session/totp.tsx

  • Add e.preventDefault() to verifyTotp to stop native form submission
  • Rewrite handleKeyDown to call e.preventDefault() + form.requestSubmit() instead of invoking verifyTotp() directly

  const verifyTotp = async (e: FormEvent<HTMLFormElement>) => {
    e.preventDefault()
    post(tuyau.session.totp.$url())
  }
  
  const handleKeyDown = (e: React.KeyboardEvent<HTMLInputElement>) => {
    if (e.key === 'Enter') {
      e.preventDefault()
      e.currentTarget.form?.requestSubmit()
    }
  }

• tests/browser/auth.spec.ts

  • Submit the invalid OTP test via press('Enter') to exercise the handleKeyDown branch, raising totp.tsx branch coverage from 33% → above the 50% threshold

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.

[davideluque]

Addressed in the original PR #447 — the duplicate onKeyDown binding was removed in commit 0f8c757.