2FA-Challenge: Fehlversuch crasht nicht mehr (Route two-factor.login fehlt)

Fortifys FailedTwoFactorLoginResponse leitet auf die Route
two-factor.login um, die bei views => false nie registriert wird
(RouteNotFoundException). Eigener Response leitet zurück auf die
Volt-Challenge-Seite und meldet den Fehler auf Deutsch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/Feature/Auth/TwoFactorLoginTest.php

@@ -78,6 +78,35 @@ test('a valid two-factor code completes login with a role-aware redirect', funct
     $this->assertAuthenticatedAs($customer);
 });
 
+test('an invalid two-factor code returns to the challenge page with an error', function () {
+    /** @var TestCase $this */
+    $user = User::factory()->create(['is_active' => true]);
+    enableTwoFactor($user);
+
+    $this->withSession(['login.id' => $user->id, 'login.remember' => false])
+        ->post('/two-factor-challenge', ['code' => '000000'])
+        ->assertRedirect(route('two-factor.challenge'))
+        ->assertSessionHasErrors('code');
+
+    $this->assertGuest();
+});
+
+test('an invalid recovery code returns to the challenge page with an error', function () {
+    /** @var TestCase $this */
+    $user = User::factory()->create(['is_active' => true]);
+    enableTwoFactor($user);
+    $user->forceFill([
+        'two_factor_recovery_codes' => encrypt(json_encode(['gueltiger-code'])),
+    ])->save();
+
+    $this->withSession(['login.id' => $user->id, 'login.remember' => false])
+        ->post('/two-factor-challenge', ['recovery_code' => 'falscher-code'])
+        ->assertRedirect(route('two-factor.challenge'))
+        ->assertSessionHasErrors('recovery_code');
+
+    $this->assertGuest();
+});
+
 test('the fortify login post blocks inactive but verified users', function () {
     /** @var TestCase $this */
     $user = User::factory()->create(['is_active' => false]);