test(e2e): read the replay verdict instead of inferring it from a 401

The replay control submitted the enrolment code at the login challenge and
asserted a 401. That 401 is the same answer the route gives a code that has
simply drifted out of its ±1-step window, and by the time the journey reached
the challenge — a rotation, a refused rotation, a sign-out, a page load and an
Argon2id verify later — the enrolment code usually had. Out of window, the
refusal happens before the monotonic floor is ever consulted, so the control
could pass with the floor deleted.

Both TOTP refusals now assert the verdict the route records itself,
auth.mfa.failed with details.replay, written and awaited before it answers:
false for a code that never matched the secret, true for the replay. Flipping
that verdict while leaving the refusal in place turns the positive half red,
which is what the old assertion could not do.

The replayed code is the one the previous sign-in just spent, so the window is
a property of the journey rather than of the wall clock: the accept is taken at
a step boundary when the current step has too little left, which bounds the
wait by one period and leaves the pair at least two.

The rotation stages no longer press Escape to get the confirmation out of the
way. They assert the card closes it, by test id.

e2e/setup/mfa-journey-fixture.ts

@@ -187,6 +187,51 @@ export async function latestChallengeAttempts(
   }
 }
 
+/**
+ * The server's own verdict on the account's most recent refused factor.
+ *
+ * `/api/auth/mfa/verify` answers every refusal with the same 401, so the wire
+ * cannot tell a replayed code from a wrong one — and that distinction is the
+ * whole subject of the replay control. The route does record it: it writes
+ * `auth.mfa.failed` with `details.replay` and AWAITS that write before
+ * responding, so the row is on disk by the time the response lands.
+ *
+ * Read it rather than inferring it. A replayed code that has drifted out of its
+ * ±1-step window is refused as out-of-window — same 401, `replay: false` — and
+ * a control that only reads the status code cannot tell the two apart, which
+ * means it would stay green with the replay floor deleted.
+ */
+export async function latestMfaFailure(
+  account: MfaJourneyAccount,
+): Promise<{ replay: boolean }> {
+  const pool = connect();
+  try {
+    const res = await pool.query<{ details: string | null }>(
+      `SELECT details FROM audit_logs
+        WHERE user_id = (SELECT id FROM users WHERE username = $1)
+          AND action = 'auth.mfa.failed'
+        ORDER BY created_at DESC
+        LIMIT 1`,
+      [account.username],
+    );
+    const row = res.rows[0];
+    if (!row?.details) {
+      throw new Error(
+        `[mfa-journey-fixture] no refused factor recorded for ${account.username}`,
+      );
+    }
+    const details = JSON.parse(row.details) as { replay?: unknown };
+    if (typeof details.replay !== "boolean") {
+      throw new Error(
+        `[mfa-journey-fixture] refusal for ${account.username} carries no replay verdict`,
+      );
+    }
+    return { replay: details.replay };
+  } finally {
+    await pool.end();
+  }
+}
+
 /**
  * Age the session's step-up stamp past the five-minute window.
  *