KemalIdentity::MFA::VerificationResult

The result of presenting a second factor.

Failed is the same struct a password or a bearer token produces, so RateLimited carries a retry_after here exactly as it does there, and every reason stays out of the response for the same reason: which of "wrong code", "already used" and "no such factor" it was is for the audit log, not for whoever is guessing.