fix(mfa): /mfa/webauthn/options enumeration-safe (200 totp fallback au lieu de 400) + test

backend/auth/router.py

@@ -565,15 +565,13 @@ async def mfa_webauthn_remove(
 async def mfa_webauthn_login_options(body: dict = Body(...)):
     """Unauthenticated: begin the login assertion for a user with registered keys.
 
-    Returns null options (mfa_method 'totp') when the user has no WebAuthn keys.
+    Enumeration-safe: always 200 — returns null options (caller falls back to
+    TOTP/recovery UI) when the user has no WebAuthn key or MFA is off.
     """
     username = str(body.get("username", ""))
     user = get_user(username)
-    if not user or not user.get("mfa_enabled"):
-        raise HTTPException(400, "MFA non activé pour cet utilisateur")
-
-    creds = user.get("webauthn_credentials", [])
-    if not creds:
+    creds = (user or {}).get("webauthn_credentials", [])
+    if not user or not user.get("mfa_enabled") or not creds:
         return {"mfa_method": "totp", "options": None}
 
     from .webauthn_mfa import begin_authentication