fix(mfa): /mfa/webauthn/options enumeration-safe (200 totp fallback au lieu de 400) + test

tests/test_webauthn.py

@@ -309,6 +309,13 @@ class TestWebauthnApi:
                             json={"username": "testuser", "credential": assertion})
         assert v2.status_code == 401
 
+    def test_login_options_enumeration_safe(self, wa_client):
+        # Unknown user / no MFA -> always 200 with totp fallback, no 404/400 leak
+        r = wa_client.post("/api/auth/mfa/webauthn/options",
+                           json={"username": "ghost-user"})
+        assert r.status_code == 200
+        assert r.json() == {"mfa_method": "totp", "options": None}
+
     def test_remove_key_disables_mfa(self, wa_client):
         headers = _login_headers(wa_client)
         options = wa_client.post("/api/auth/mfa/webauthn/register/options",