33268b38ae86eb4e0be9a3f0e1123f9b860d2121
The TOTP verification endpoint always created refresh tokens with remember_me=false and 1-hour expiry, regardless of what the user selected at login. Fix: - Frontend now sends remember_me in the TOTP verify request body - Backend reads remember_me and uses it for token expiry (30 days) and cookie maxAge Users with 2FA who checked "remember me" will now stay logged in for 30 days instead of being kicked out after 1 hour. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Description
No description provided