auth-ops

No malicious behavior or intentional supply-chain attack is evident. The code is readable defensive-authentication guidance, but it contains several production security caveats: token and challenge consumption should be atomic and single-use, magic-link GET authentication should account for scanners and replay, MFA enrollment and verification need stronger controls, API-key prefix lookup needs collision-safe handling, and sensitive MFA secrets require stronger storage protection. Overall risk is moderate due to implementation weaknesses, not malware.