Backend returns code '2fa_required' but frontend checked for 'totp_required', so the TOTP input field never appeared. Also fix the same Svelte pattern brace escaping issue as in TOTPSetup.