fix(2FA): return 429 when too many failed attemps

src/app/api/2fa/disable/route.ts

@@ -73,11 +73,16 @@ export async function POST(request: Request) {
   // Verify rate limit
   const rateCheck = await checkRateLimit(userId);
   if (!rateCheck.allowed) {
-    return badRequest({
-      code: 'two-factor-error-too-many-attempts',
-      message: 'Too many failed attempts',
-      lockedUntil: rateCheck.lockedUntil,
-    });
+    return Response.json(
+      {
+        error: {
+          code: 'two-factor-error-too-many-attempts',
+          message: 'Too many failed attempts',
+          lockedUntil: rateCheck.lockedUntil,
+        },
+      },
+      { status: 429 },
+    );
   }
 
   // Prevent OTP replay

src/app/api/2fa/setup/confirm/route.ts

@@ -33,11 +33,16 @@ export async function POST(request: Request) {
   // Verify rate limit
   const rateCheck = await checkRateLimit(userId);
   if (!rateCheck.allowed) {
-    return badRequest({
-      code: 'two-factor-error-too-many-attempts',
-      message: 'Too many failed attempts',
-      lockedUntil: rateCheck.lockedUntil,
-    });
+    return Response.json(
+      {
+        error: {
+          code: 'two-factor-error-too-many-attempts',
+          message: 'Too many failed attempts',
+          lockedUntil: rateCheck.lockedUntil,
+        },
+      },
+      { status: 429 },
+    );
   }
 
   // Prevent OTP replay