Fix untracked cache files and CI flake in TOTP verification

.gitignore

@@ -23,3 +23,10 @@ frontend/dist
 # NOTE: `frontend/src` was previously listed here, which silently excluded the entire frontend
 # source tree from new commits. The existing files stayed tracked only because they were added
 # before the rule. Removed deliberately — see CHANGELOG.
+
+# Playwright MCP session cache -- console logs + page snapshots regenerated on every
+# browser-automation run, never project content.
+.playwright-mcp/
+
+# macOS Finder metadata.
+.DS_Store

backend/app/services/identity/auth.py

@@ -70,4 +70,11 @@ def totp_provisioning_uri(secret: str, email: str) -> str:
 
 
 def verify_totp(secret: str, code: str) -> bool:
-    return pyotp.TOTP(secret).verify(code)
+    """`valid_window=1` accepts the current 30-second window plus one on either side (RFC 6238's
+    recommended tolerance for clock drift and network latency) -- the library's own default,
+    `valid_window=0`, has zero tolerance and rejects a genuinely correct code whenever the
+    login-then-verify round trip crosses a window boundary. Real network jitter can trigger that,
+    which is what surfaced as a nondeterministic CI failure in
+    `test_mfa_enroll_reset_rejects_the_wrong_password` (passed on the identical code an hour
+    earlier)."""
+    return pyotp.TOTP(secret).verify(code, valid_window=1)

frontend/vite.config.js

@@ -7,11 +7,11 @@ export default defineConfig({
   server: {
     proxy: {
       '/api': {
-        target: 'http://localhost:5001',
+        target: 'http://localhost:5000',
         changeOrigin: true,
       },
       '/health': {
-        target: 'http://localhost:5001',
+        target: 'http://localhost:5000',
         changeOrigin: true,
       },
     },