Password-gate the QR, single-line tab, logo-left header, 10-min code

Shipped

July 16, 2026 at 12:59 AM UTC

Author

kamo

Commit

6d9a8ed

- Member must re-enter their password (server-verified via /api/mobile-access-otk, which mints the OTK only on success) before the QR is revealed — prevents someone at an already-signed-in computer from grabbing it. - QR/OTK now lives 10 minutes (600s); countdown then re-locks. - Tab label forced to one line; logo moved left of the title to save vertical space; removed the 'Configuring for' pill.