==============================================================================
One-time token login - the way in, and the way back after a lost device
==============================================================================

=== One-time token: the way in when there is no passkey yet, and the way back ===
POST /ott/generate -> HTTP 302, Location: http://localhost:8080/login/ott
token delivered out of band (the handler wrote it to a file): c5a7e60d-acd0-48a7-bb90-c03195fd783b
POST /login/ott -> HTTP 302, Location: http://localhost:8080/

$ GET /me
HTTP 200
{"name":"user","authenticationType":"OneTimeTokenAuthentication","authorities":["FactorGrantedAuthority [authority=FACTOR_OTT, issuedAt=2026-08-25T17:21:08.899894517Z]","ROLE_USER"]}

=== The same token, a second time ===
POST /login/ott -> HTTP 302, Location: http://localhost:8080/login?error