fix: login 2FA bloque sans erreur BUG-069 (challenge montait dans .login-box inexistant -> .login-card + erreur visible)

frontend/js/auth.js

@@ -552,8 +552,22 @@ function _startWebauthnLogin(mfaSection, username, rememberMe) {
 
 
 function showMfaChallenge(username, rememberMe, loginBtn, loginErrorEl, mfaMethod) {
-  const loginBox = document.querySelector(".login-box");
-  if (!loginBox) return;
+  // BUG-069: the challenge used to mount into `.login-box`, which does not
+  // exist in index.html (the login markup is `#login-screen > .login-card >
+  // #login-form`) — querySelector returned null and the function silently
+  // returned, leaving the user stuck on the login page with no error after
+  // entering correct credentials. Mount into the real card, and never fail
+  // silently: surface the problem in the login error box instead.
+  const loginBox = document.querySelector(".login-card")
+    || document.getElementById("login-screen");
+  if (!loginBox) {
+    const fallback = loginErrorEl || document.getElementById("login-error");
+    if (fallback) {
+      fallback.textContent = t("mfa.challenge_unavailable");
+      fallback.classList.remove("hidden");
+    }
+    return;
+  }
 
   // Hide the normal login form
   const loginForm = document.getElementById("login-form");

frontend/locales/en.json

@@ -1899,6 +1899,7 @@
   "mfa.password_change_btn": "Change password",
   "mfa.password_mismatch": "The two passwords do not match.",
   "mfa.password_changed": "Password updated.",
+  "mfa.challenge_unavailable": "Verification screen unavailable — please reload the page.",
   "bookslm.title": "BooksLM",
   "bookslm.files_indexed": "{count} files indexed",
   "bookslm.chars_loaded": "{chars} chars loaded",

frontend/locales/fr.json

@@ -1899,6 +1899,7 @@
   "mfa.password_change_btn": "Changer le mot de passe",
   "mfa.password_mismatch": "Les deux mots de passe ne correspondent pas.",
   "mfa.password_changed": "Mot de passe mis à jour.",
+  "mfa.challenge_unavailable": "Écran de vérification indisponible — veuillez recharger la page.",
   "bookslm.title": "BooksLM",
   "bookslm.files_indexed": "{count} fichiers indexés",
   "bookslm.chars_loaded": "{chars} caractères chargés",